sheetrat | 12e3afd94f250411dcd755ba34f67fea0947ccdbf75502775f1e5f1d381806d2

General

Target
2026-07-10_4664df98db555e6ef2616699f2f8dcad_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 375KB
Sample260710-mkbmbahy5k
SHA256 12e3afd94f250411dcd755ba34f67fea0947ccdbf75502775f1e5f1d381806d2
MD5 4664df98db555e6ef2616699f2f8dcad
SHA1 52fab340f2ae1ba66aa67e28838005fa00979904
SHA512 d29d446ce1119a17142005208edef8fe4295031016a1c6fe4304b9b116a8aa1ad7e58b61c6a2e61eb6c7cf06e8f4e70ed99a60817ab521cd211074a157fed1f6
SSDEEP 6144:445WmsOxz29wz4ZoeETEW1gbpJA3KpSL0pD8lbu:44UmsOV29ULePJA3KY0pAY
TLSH
T16D845A43BBD100BAE5BE453844735A19A73AF8114B62EBDF169404ED0F26BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-10_4664df98db555e6ef2616699f2f8dcad_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 375KB
- SHA256 12e3afd94f250411dcd755ba34f67fea0947ccdbf75502775f1e5f1d381806d2
- MD5 4664df98db555e6ef2616699f2f8dcad
- SHA1 52fab340f2ae1ba66aa67e28838005fa00979904
- SHA512 d29d446ce1119a17142005208edef8fe4295031016a1c6fe4304b9b116a8aa1ad7e58b61c6a2e61eb6c7cf06e8f4e70ed99a60817ab521cd211074a157fed1f6
- SSDEEP 6144:445WmsOxz29wz4ZoeETEW1gbpJA3KpSL0pD8lbu:44UmsOV29ULePJA3KY0pAY
- TLSH
  T16D845A43BBD100BAE5BE453844735A19A73AF8114B62EBDF169404ED0F26BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2