sheetrat | 1518d06c127ab15a628c2f9760dec4b726b3531757b5d689692e2b8292c6f37f

General

Target
2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid
Size 50.0MB
Sample260720-jp6fpsdt9s
SHA256 1518d06c127ab15a628c2f9760dec4b726b3531757b5d689692e2b8292c6f37f
MD5 3480ab31c9f1b32e8b40768ca280e665
SHA1 d3c47c823e9025f5d650b32292413430189e6d6e
SHA512 1f96bd652ede0f27434e0e70a8b6d4456f6d8be757a8021c73172b56689b9a83ef4a8c5c1fc35d30b9221064d627677f0070d29fb4f41636426f50db052349a9
SSDEEP 393216:3qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqa:q
TLSH
T142B702DF3444667AB1E33A74F54F0A7184E971873F341E4C26E51ADA2E8C273EAA2153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid
- Size 50.0MB
- SHA256 1518d06c127ab15a628c2f9760dec4b726b3531757b5d689692e2b8292c6f37f
- MD5 3480ab31c9f1b32e8b40768ca280e665
- SHA1 d3c47c823e9025f5d650b32292413430189e6d6e
- SHA512 1f96bd652ede0f27434e0e70a8b6d4456f6d8be757a8021c73172b56689b9a83ef4a8c5c1fc35d30b9221064d627677f0070d29fb4f41636426f50db052349a9
- SSDEEP 393216:3qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqa:q
- TLSH
  T142B702DF3444667AB1E33A74F54F0A7184E971873F341E4C26E51ADA2E8C273EAA2153
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2