sheetrat | a0c5225c08fc66c658ba064462622898440cf054686b853cb8d0341ac8bff2b3

General

Target
2026-05-05_813deb0020e3bb462aa075c0241e32ad_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 374KB
Sample260505-eajaeafy8z
SHA256 a0c5225c08fc66c658ba064462622898440cf054686b853cb8d0341ac8bff2b3
MD5 813deb0020e3bb462aa075c0241e32ad
SHA1 13508fdf75c9d67a8e626a4acfd3775ffb553d14
SHA512 04a7769c2f549f3610164fa366906410c27b8db1e3e372d3b5c6f8e789c65d6e95623101cd131cd84859c20906cb34677e1776e2ccfef170b7262af08db5ae2c
SSDEEP 6144:L3veE9wz4ZoeETEW1gbpJA3KpSL0pDgVNZKb:L3v39ULePJA3KY0poZ
TLSH
T12A844A43BBD000BAD5BE463948735619A73AF8114B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-05_813deb0020e3bb462aa075c0241e32ad_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 374KB
- SHA256 a0c5225c08fc66c658ba064462622898440cf054686b853cb8d0341ac8bff2b3
- MD5 813deb0020e3bb462aa075c0241e32ad
- SHA1 13508fdf75c9d67a8e626a4acfd3775ffb553d14
- SHA512 04a7769c2f549f3610164fa366906410c27b8db1e3e372d3b5c6f8e789c65d6e95623101cd131cd84859c20906cb34677e1776e2ccfef170b7262af08db5ae2c
- SSDEEP 6144:L3veE9wz4ZoeETEW1gbpJA3KpSL0pDgVNZKb:L3v39ULePJA3KY0poZ
- TLSH
  T12A844A43BBD000BAD5BE463948735619A73AF8114B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Custom signature
  
  Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Custom signature
  
  Detects executables (downlaoders) containing URLs to raw contents of a paste
- Custom signature
  
  Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2