sheetrat | 137b825e93d9ab2663cd3c076d0d524d5663c9f65c2a128708589b814dbeb88e

General

Target
2026-08-03_667bc7560cb6fa5f1b378171de6d1a2b_amadey_asyncrat_cobalt-strike_darkgate_elex_glassworm_icedid_luca-stealer_njrat
Size 12.1MB
Sample260803-c3hhgaxaka
SHA256 137b825e93d9ab2663cd3c076d0d524d5663c9f65c2a128708589b814dbeb88e
MD5 667bc7560cb6fa5f1b378171de6d1a2b
SHA1 9c3ab43578a14196d65750f87e5f986912007486
SHA512 4d132b58dea46ac1b4dd56483005f59a0ed2c9fd3497207f3bd00da880b78b951a0d5f48998023d30f030043ff818e7ed4a76ce24a935be9ae1e77a56032687d
SSDEEP 196608:aAd3w0AEYzDXEpXnH2ph1igt1/1QpL0uQg+xeukj4tKsvoKgpVFSZZ:a81FYzDXEAphJtrQSg+xeXjoKsvFgtS
TLSH
T196D62392B3C405F8F4BE45386491492583B3BC396BA5D6DF22A474A90E637C3DE30F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-03_667bc7560cb6fa5f1b378171de6d1a2b_amadey_asyncrat_cobalt-strike_darkgate_elex_glassworm_icedid_luca-stealer_njrat
- Size 12.1MB
- SHA256 137b825e93d9ab2663cd3c076d0d524d5663c9f65c2a128708589b814dbeb88e
- MD5 667bc7560cb6fa5f1b378171de6d1a2b
- SHA1 9c3ab43578a14196d65750f87e5f986912007486
- SHA512 4d132b58dea46ac1b4dd56483005f59a0ed2c9fd3497207f3bd00da880b78b951a0d5f48998023d30f030043ff818e7ed4a76ce24a935be9ae1e77a56032687d
- SSDEEP 196608:aAd3w0AEYzDXEpXnH2ph1igt1/1QpL0uQg+xeukj4tKsvoKgpVFSZZ:a81FYzDXEAphJtrQSg+xeXjoKsvFgtS
- TLSH
  T196D62392B3C405F8F4BE45386491492583B3BC396BA5D6DF22A474A90E637C3DE30F66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation pyinstaller trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2