sheetrat | ed835ac73cef7f3de8eddb385e51383b4535e4352523ddd6aac80ad98fb53e0f

General

Target
2026-08-04_d83f9b44e952b42311f1e7ace9a3806b_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 445KB
Sample260804-fyn18ssanb
SHA256 ed835ac73cef7f3de8eddb385e51383b4535e4352523ddd6aac80ad98fb53e0f
MD5 d83f9b44e952b42311f1e7ace9a3806b
SHA1 0090052e0e70cf654498fdb3694b7293b03bc013
SHA512 37c5a5b46091086cc5dc0151c65aa7dd5a98bb0aba6f87c32600beaefe540eb1fc95f99d4466220889d17f0b954991e1dcfd977ed73367c428fc1848586d7701
SSDEEP 12288:FKbTIt1PjSia1N9ULePJA3KY0pjnDEpUP:sbTiuf9UqPJA3o1
TLSH
T1EEA45942B7D504B9E5BE863848735A15973AFC214B62EBDF168424ED0E32BC2DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-04_d83f9b44e952b42311f1e7ace9a3806b_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 445KB
- SHA256 ed835ac73cef7f3de8eddb385e51383b4535e4352523ddd6aac80ad98fb53e0f
- MD5 d83f9b44e952b42311f1e7ace9a3806b
- SHA1 0090052e0e70cf654498fdb3694b7293b03bc013
- SHA512 37c5a5b46091086cc5dc0151c65aa7dd5a98bb0aba6f87c32600beaefe540eb1fc95f99d4466220889d17f0b954991e1dcfd977ed73367c428fc1848586d7701
- SSDEEP 12288:FKbTIt1PjSia1N9ULePJA3KY0pjnDEpUP:sbTiuf9UqPJA3o1
- TLSH
  T1EEA45942B7D504B9E5BE863848735A15973AFC214B62EBDF168424ED0E32BC2DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2