sheetrat | eba9ea797869c23eae4e6c78a5b5290ad1c0e50dcfc10ca216063cbd79c73195

General

Target
2026-04-15_9f386a39aaf96ebdc6776d704dc3d3b1_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 375KB
Sample260415-fd1vasas9v
SHA256 eba9ea797869c23eae4e6c78a5b5290ad1c0e50dcfc10ca216063cbd79c73195
MD5 9f386a39aaf96ebdc6776d704dc3d3b1
SHA1 35e08d2e131a23ded97fd818f62f062b21f7dee9
SHA512 4e1d3b8d5d8641af974b9444c18fb1ccee7f73b87f11f9b91149d70df080b5f92c5eca7242b6b069552995714bf39f13d26e511ca9e9581459562991d8767367
SSDEEP 6144:OR1lq9wz4ZoeETEW1gbpJA3KpSL0pDyC1Kbd:OR1M9ULePJA3KY0pt1a
TLSH
T159845A43BBD000BAE5BE463844735619A73AF8115B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-15_9f386a39aaf96ebdc6776d704dc3d3b1_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 375KB
- SHA256 eba9ea797869c23eae4e6c78a5b5290ad1c0e50dcfc10ca216063cbd79c73195
- MD5 9f386a39aaf96ebdc6776d704dc3d3b1
- SHA1 35e08d2e131a23ded97fd818f62f062b21f7dee9
- SHA512 4e1d3b8d5d8641af974b9444c18fb1ccee7f73b87f11f9b91149d70df080b5f92c5eca7242b6b069552995714bf39f13d26e511ca9e9581459562991d8767367
- SSDEEP 6144:OR1lq9wz4ZoeETEW1gbpJA3KpSL0pDyC1Kbd:OR1M9ULePJA3KY0pt1a
- TLSH
  T159845A43BBD000BAE5BE463844735619A73AF8115B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution exploit sheetrat persistence ransomware trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Custom signature
  
  Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Custom signature
  
  Detects executables (downlaoders) containing URLs to raw contents of a paste
- Custom signature
  
  Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2