sheetrat | 60021065d3576450ec76835687cfcac4b1d5cc4a08b4f528f6f4eb3b7c0fb2ec

General

Target
2026-07-05_22d0b07a69f1f00b5a655d63251d231e_amadey_cloudeye_darkgate_elex_glassworm_icedid
Size 2.2MB
Sample260705-tsfpkadz2v
SHA256 60021065d3576450ec76835687cfcac4b1d5cc4a08b4f528f6f4eb3b7c0fb2ec
MD5 22d0b07a69f1f00b5a655d63251d231e
SHA1 39b7268ff907856b4585bf891dbfe756d8a3b0cb
SHA512 2ebe65e6b0034b0bcdeaed6fb4bead735c0e1c63caf546fd6b55b303b9564d468bfb4b52314973aa1dfd9a9fc42b71e8b323c59ecdcfabaf33a83a51e991c5d4
SSDEEP 49152:YtPJAaz4Layct6Kw+4HNqzK8e8/rDcA8q9k4iKV/NGgxR:Yt466Kw+8Ucdrg/NBxR
TLSH
T1CDB50202B7C040BAD4BE463089775655A7B7F8210B72EBCB67511EAC2E227D3DD38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-05_22d0b07a69f1f00b5a655d63251d231e_amadey_cloudeye_darkgate_elex_glassworm_icedid
- Size 2.2MB
- SHA256 60021065d3576450ec76835687cfcac4b1d5cc4a08b4f528f6f4eb3b7c0fb2ec
- MD5 22d0b07a69f1f00b5a655d63251d231e
- SHA1 39b7268ff907856b4585bf891dbfe756d8a3b0cb
- SHA512 2ebe65e6b0034b0bcdeaed6fb4bead735c0e1c63caf546fd6b55b303b9564d468bfb4b52314973aa1dfd9a9fc42b71e8b323c59ecdcfabaf33a83a51e991c5d4
- SSDEEP 49152:YtPJAaz4Layct6Kw+4HNqzK8e8/rDcA8q9k4iKV/NGgxR:Yt466Kw+8Ucdrg/NBxR
- TLSH
  T1CDB50202B7C040BAD4BE463089775655A7B7F8210B72EBCB67511EAC2E227D3DD38B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2