sheetrat | 1f94285860d44148ac3bcaabc57dc66fa1dab29bb3ae73c8fe7762eb852a9c5e

General

Target
2026-07-19_d02cad64d5c9ac687ef2bf05e25baa9c_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 402KB
Sample260719-dkd8rsas9n
SHA256 1f94285860d44148ac3bcaabc57dc66fa1dab29bb3ae73c8fe7762eb852a9c5e
MD5 d02cad64d5c9ac687ef2bf05e25baa9c
SHA1 0bc09225a150bb2daae74850191714742732e70f
SHA512 cb4157faac759aee2f509a6b8d78c62035b7d0f2694015fe31b3289a2f6fe5ae8bc60fd83d64ff098d34cfdd57a6fd59fedd03c0341bcdab559766a0674ebc34
SSDEEP 6144:agTr10W3il9wz4ZoeETEW1gbpJA3KpSL0pDopOYbTS:agTruW3Q9ULePJA3KY0pcUoS
TLSH
T184944A43B7D504B9E5BE463848725615A73AF8214B62EBDF1A9404ED0E33BC2DE34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-19_d02cad64d5c9ac687ef2bf05e25baa9c_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 402KB
- SHA256 1f94285860d44148ac3bcaabc57dc66fa1dab29bb3ae73c8fe7762eb852a9c5e
- MD5 d02cad64d5c9ac687ef2bf05e25baa9c
- SHA1 0bc09225a150bb2daae74850191714742732e70f
- SHA512 cb4157faac759aee2f509a6b8d78c62035b7d0f2694015fe31b3289a2f6fe5ae8bc60fd83d64ff098d34cfdd57a6fd59fedd03c0341bcdab559766a0674ebc34
- SSDEEP 6144:agTr10W3il9wz4ZoeETEW1gbpJA3KpSL0pDopOYbTS:agTruW3Q9ULePJA3KY0pcUoS
- TLSH
  T184944A43B7D504B9E5BE463848725615A73AF8214B62EBDF1A9404ED0E33BC2DE34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution sheetrat persistence privilege_escalation ransomware trojan exploit
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2