sheetrat | 66c89100502e2de53f6e845daad412381bf212008ac0e8a636d1cf70eb9879c7

General

Target
2026-06-30_f4c6757f1153c99963361e6004e9bc7e_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 375KB
Sample260701-chjvsscv2q
SHA256 66c89100502e2de53f6e845daad412381bf212008ac0e8a636d1cf70eb9879c7
MD5 f4c6757f1153c99963361e6004e9bc7e
SHA1 30b50007f6a6d5f4cc89e0bb70735bc4844070f9
SHA512 ff537d861217dc4608fbd7af6026da1eeba9b8ef61b3ac2759264b2982636a959280b702eb6886b1ae4130be0ff9c17d8988e9479dec5d3b80be28537004ac8f
SSDEEP 6144:FsRl79wz4ZoeETEW1gbpJA3KpSL0pDxe3Tz/bu:FsRF9ULePJA3KY0pIzy
TLSH
T115844A43BBD000BAE5BE463944735619A73AF8114B62EBDF169404ED0F27BC69D38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-30_f4c6757f1153c99963361e6004e9bc7e_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 375KB
- SHA256 66c89100502e2de53f6e845daad412381bf212008ac0e8a636d1cf70eb9879c7
- MD5 f4c6757f1153c99963361e6004e9bc7e
- SHA1 30b50007f6a6d5f4cc89e0bb70735bc4844070f9
- SHA512 ff537d861217dc4608fbd7af6026da1eeba9b8ef61b3ac2759264b2982636a959280b702eb6886b1ae4130be0ff9c17d8988e9479dec5d3b80be28537004ac8f
- SSDEEP 6144:FsRl79wz4ZoeETEW1gbpJA3KpSL0pDxe3Tz/bu:FsRF9ULePJA3KY0pIzy
- TLSH
  T115844A43BBD000BAE5BE463944735619A73AF8114B62EBDF169404ED0F27BC69D38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit sheetrat persistence ransomware trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2