sheetrat | a95bbd75f40d5bcd017ad594071f44168a50facbc79ccd5b809b051bff8dae7e

General

Target
2026-07-02_d3b251d2eae0c92a63946a969fae1ca8_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 388KB
Sample260702-cgxp9saz51
SHA256 a95bbd75f40d5bcd017ad594071f44168a50facbc79ccd5b809b051bff8dae7e
MD5 d3b251d2eae0c92a63946a969fae1ca8
SHA1 7f7100df77412268afea771be92fd9ba6bde8fe2
SHA512 98f183bd9c89743627560ffa9e32f3c8317b4f595bef6e1f0e2c35d700500aeeab6440125a1e2e5b1f255de5f39833439f9179aabbf9084135fbffd1f4f45ec2
SSDEEP 6144:MFG2ITF9wz4ZoeETEW1gbpJA3KpSL0pDCTupGbe:MFGfTF9ULePJA3KY0pKupZ
TLSH
T176845A43B7D400B9E5BE4A7848735615A73AB8218B72EBDF169404ED0E23BC6DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-02_d3b251d2eae0c92a63946a969fae1ca8_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 388KB
- SHA256 a95bbd75f40d5bcd017ad594071f44168a50facbc79ccd5b809b051bff8dae7e
- MD5 d3b251d2eae0c92a63946a969fae1ca8
- SHA1 7f7100df77412268afea771be92fd9ba6bde8fe2
- SHA512 98f183bd9c89743627560ffa9e32f3c8317b4f595bef6e1f0e2c35d700500aeeab6440125a1e2e5b1f255de5f39833439f9179aabbf9084135fbffd1f4f45ec2
- SSDEEP 6144:MFG2ITF9wz4ZoeETEW1gbpJA3KpSL0pDCTupGbe:MFGfTF9ULePJA3KY0pKupZ
- TLSH
  T176845A43B7D400B9E5BE4A7848735615A73AB8218B72EBDF169404ED0E23BC6DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2