sheetrat | 2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid
Size 10.0MB
Sample260630-wp7d8aew4z
SHA256 7484bebb5e0f58dba1baa8eba0500d86ac68b59cb2e9b46ab79145988fa85e92
MD5 d9353d736d1f9dedec5fcbece80d820d
SHA1 ff68784f1ddcebb35bdbefc1f51b71f4c812705d
SHA512 c5216c80d76605a9bf743c695667a9a85965a4b7cafcacd0bc534c5d52fc6ace32cce6c0f6f2017555c7626596157645799c3dd75d5736ed95707a7ff8feeeec
SSDEEP 6144:JqmhL9wz4ZoeETEW1gbpJA3KpSL0pDw7KbY:Jqmx9ULePJA3KY0p2J
TLSH
T16BB64A43BBD000BAD5BE453844735619A77AF8218B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan sheetrat

Malware Config

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
sample	family_sheetrat_v1

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid

File Explorer

2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid

.exe 10.0MB

2026-06-30_d9353d736d1f9dedec5fcbece80d820d_amadey_darkgate_glassworm_icedid

SHA256 7484bebb5e0f58dba1baa8eba0500d86ac68b59cb2e9b46ab79145988fa85e92
MD5 d9353d736d1f9dedec5fcbece80d820d
SHA1 ff68784f1ddcebb35bdbefc1f51b71f4c812705d
SHA512 c5216c80d76605a9bf743c695667a9a85965a4b7cafcacd0bc534c5d52fc6ace32cce6c0f6f2017555c7626596157645799c3dd75d5736ed95707a7ff8feeeec
SSDEEP 6144:JqmhL9wz4ZoeETEW1gbpJA3KpSL0pDw7KbY:Jqmx9ULePJA3KY0p2J
TLSH
T16BB64A43BBD000BAD5BE453844735619A77AF8218B62EBDF169404ED0E27BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Sheetrat Payload

Sheetrat aka NonEuclid RAT is a trojan written in C#.
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables (downlaoders) containing URLs to raw contents of a paste
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths