sheetrat | 7ec31b49fc75424db7021eef455074b7b33121be6b268c6215b06521d3732caf

General

Target
2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 420KB
Sample260722-2ecprawdle
SHA256 7ec31b49fc75424db7021eef455074b7b33121be6b268c6215b06521d3732caf
MD5 0e7d8466d611b6c886243bd0510866a4
SHA1 23b2e54e813d287d01459ebc6a656b2262f3ebb8
SHA512 4a2bd7a1408f4cacf0a4125f282e11da7ef6ae7b37a2f8d52d80efb25bf45c129ba493947c612a43712b6a55c0f2e2311638b2445dfeb38ad74bd72ab53487e4
SSDEEP 6144:wUCbbyU4zvN9fI2LyC9wz4ZoeETEW1gbpJA3KpSL0pDz5kUbtdB:wTbbyU4zvN9A2X9ULePJA3KY0pOm
TLSH
T13D945943B7D504B9E1BE867848726615977AF8214B72EBDF168404ED0E32BC2DE34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-22_0e7d8466d611b6c886243bd0510866a4_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 420KB
- SHA256 7ec31b49fc75424db7021eef455074b7b33121be6b268c6215b06521d3732caf
- MD5 0e7d8466d611b6c886243bd0510866a4
- SHA1 23b2e54e813d287d01459ebc6a656b2262f3ebb8
- SHA512 4a2bd7a1408f4cacf0a4125f282e11da7ef6ae7b37a2f8d52d80efb25bf45c129ba493947c612a43712b6a55c0f2e2311638b2445dfeb38ad74bd72ab53487e4
- SSDEEP 6144:wUCbbyU4zvN9fI2LyC9wz4ZoeETEW1gbpJA3KpSL0pDz5kUbtdB:wTbbyU4zvN9A2X9ULePJA3KY0pOm
- TLSH
  T13D945943B7D504B9E1BE867848726615977AF8214B72EBDF168404ED0E32BC2DE34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1 behavioral2