sheetrat | 9eb813b403c080152f686449d355c6efd33b19e0b7af60b50b45631aee1bc986

General

Target
2026-07-01_d8aedded098f695da1b3332f24c68e7b_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 402KB
Sample260701-jasajaa16y
SHA256 9eb813b403c080152f686449d355c6efd33b19e0b7af60b50b45631aee1bc986
MD5 d8aedded098f695da1b3332f24c68e7b
SHA1 6fd47ab038e07f4952c753e1a15a4239235badd7
SHA512 1e6920a498a357bdc6f0caa0d56bdcae8eb0a0ceee8c57927380c90960b2ade618b9be01440cb59ed57fc276e5a0b56ebb57b7c02896c1a54280ff58c60900cd
SSDEEP 6144:kVwHrXUxjTQ9wz4ZoeETEW1gbpJA3KpSL0pDky+QVYbNJ:kVwLkxjU9ULePJA3KY0p1aJ
TLSH
T1EE944A43B7D504B9E5BE453848735A15A73AF8224B62EBDF1A9404ED0E23BC1DE34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_d8aedded098f695da1b3332f24c68e7b_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 402KB
- SHA256 9eb813b403c080152f686449d355c6efd33b19e0b7af60b50b45631aee1bc986
- MD5 d8aedded098f695da1b3332f24c68e7b
- SHA1 6fd47ab038e07f4952c753e1a15a4239235badd7
- SHA512 1e6920a498a357bdc6f0caa0d56bdcae8eb0a0ceee8c57927380c90960b2ade618b9be01440cb59ed57fc276e5a0b56ebb57b7c02896c1a54280ff58c60900cd
- SSDEEP 6144:kVwHrXUxjTQ9wz4ZoeETEW1gbpJA3KpSL0pDky+QVYbNJ:kVwLkxjU9ULePJA3KY0p1aJ
- TLSH
  T1EE944A43B7D504B9E5BE453848735A15A73AF8224B62EBDF1A9404ED0E23BC1DE34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2