sheetrat | 660e25ff33960caa482422083693ebf136b428e070c711fcf54f5d8775fa181e

General

Target
2026-07-05_f9a366f5acfabccaf91a14029b4a0a71_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 389KB
Sample260705-l1tbmae19k
SHA256 660e25ff33960caa482422083693ebf136b428e070c711fcf54f5d8775fa181e
MD5 f9a366f5acfabccaf91a14029b4a0a71
SHA1 dabfe68b0c28e600c11eeec3d53f91ae93c3f84d
SHA512 44f8d1e85e361443c3f2cd94b0185eab9651aa85833563c99ed0613998dc948de5afd47aba7d6388e2319bb8065d45d0ab0c4a0853883f893a37f195a8f3caf5
SSDEEP 6144:DZkt3sBdo9wz4ZoeETEW1gbpJA3KpSL0pDdyVKb3:DZkt8Bdo9ULePJA3KY0pZyV8
TLSH
T1CF844943B7D400BAE5BE467848735615A73AB8218B72EBDF169404ED0E27BC2DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-05_f9a366f5acfabccaf91a14029b4a0a71_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 389KB
- SHA256 660e25ff33960caa482422083693ebf136b428e070c711fcf54f5d8775fa181e
- MD5 f9a366f5acfabccaf91a14029b4a0a71
- SHA1 dabfe68b0c28e600c11eeec3d53f91ae93c3f84d
- SHA512 44f8d1e85e361443c3f2cd94b0185eab9651aa85833563c99ed0613998dc948de5afd47aba7d6388e2319bb8065d45d0ab0c4a0853883f893a37f195a8f3caf5
- SSDEEP 6144:DZkt3sBdo9wz4ZoeETEW1gbpJA3KpSL0pDdyVKb3:DZkt8Bdo9ULePJA3KY0pZyV8
- TLSH
  T1CF844943B7D400BAE5BE467848735615A73AB8218B72EBDF169404ED0E27BC2DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2