sheetrat | fc381ed4ca292ebe6328c3c0a699c8a904e919e316c9513d04c28eed511a67d1

General

Target
2026-08-05_dc24f15f10b896eaabdb0941aa5a684f_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 419KB
Sample260805-lr665avame
SHA256 fc381ed4ca292ebe6328c3c0a699c8a904e919e316c9513d04c28eed511a67d1
MD5 dc24f15f10b896eaabdb0941aa5a684f
SHA1 3ae474d9dafdaf23345d6d4cfee6faf98da7bff7
SHA512 2ba4bbe8b3d32dfaa08087c345a98cabd57adb97156bade3fed499f719dbaf09f57420979e5f66454e167635da7dc45cf15dbf3faef2295d1e9e48d3d562e8c3
SSDEEP 6144:rUGbnJ6za///t5C9wz4ZoeETEW1gbpJA3KpSL0pDnlPJbiY:rbbnJ6za//V49ULePJA3KY0p5P
TLSH
T16B944943B7D504B9E5BE867948726614977AF8214B72EBDF168404ED0E32BC2DE34F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-05_dc24f15f10b896eaabdb0941aa5a684f_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 419KB
- SHA256 fc381ed4ca292ebe6328c3c0a699c8a904e919e316c9513d04c28eed511a67d1
- MD5 dc24f15f10b896eaabdb0941aa5a684f
- SHA1 3ae474d9dafdaf23345d6d4cfee6faf98da7bff7
- SHA512 2ba4bbe8b3d32dfaa08087c345a98cabd57adb97156bade3fed499f719dbaf09f57420979e5f66454e167635da7dc45cf15dbf3faef2295d1e9e48d3d562e8c3
- SSDEEP 6144:rUGbnJ6za///t5C9wz4ZoeETEW1gbpJA3KpSL0pDnlPJbiY:rbbnJ6za//V49ULePJA3KY0p5P
- TLSH
  T16B944943B7D504B9E5BE867948726614977AF8214B72EBDF168404ED0E32BC2DE34F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation ransomware trojan exploit
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2