sheetrat | 7484bebb5e0f58dba1baa8eba0500d86ac68b59cb2e9b46ab79145988fa85e92

General

Target
2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid
Size 10.0MB
Sample260630-wp7d8aew4z
SHA256 7484bebb5e0f58dba1baa8eba0500d86ac68b59cb2e9b46ab79145988fa85e92
MD5 d9353d736d1f9dedec5fcbece80d820d
SHA1 ff68784f1ddcebb35bdbefc1f51b71f4c812705d
SHA512 c5216c80d76605a9bf743c695667a9a85965a4b7cafcacd0bc534c5d52fc6ace32cce6c0f6f2017555c7626596157645799c3dd75d5736ed95707a7ff8feeeec
SSDEEP 6144:JqmhL9wz4ZoeETEW1gbpJA3KpSL0pDw7KbY:Jqmx9ULePJA3KY0p2J
TLSH
T16BB64A43BBD000BAD5BE453844735619A77AF8218B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid
- Size 10.0MB
- SHA256 7484bebb5e0f58dba1baa8eba0500d86ac68b59cb2e9b46ab79145988fa85e92
- MD5 d9353d736d1f9dedec5fcbece80d820d
- SHA1 ff68784f1ddcebb35bdbefc1f51b71f4c812705d
- SHA512 c5216c80d76605a9bf743c695667a9a85965a4b7cafcacd0bc534c5d52fc6ace32cce6c0f6f2017555c7626596157645799c3dd75d5736ed95707a7ff8feeeec
- SSDEEP 6144:JqmhL9wz4ZoeETEW1gbpJA3KpSL0pDw7KbY:Jqmx9ULePJA3KY0p2J
- TLSH
  T16BB64A43BBD000BAD5BE453844735619A77AF8218B62EBDF169404ED0E27BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence ransomware trojan exploit
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2