sheetrat | bb62439ef702cdeb86fdabe19e74559181553d9a21c82578e5ebc896cb36c448

General

Target
2026-08-08_17a2aedc8f4145d9453847fa52256602_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 396KB
Sample260808-znw4msvbnb
SHA256 bb62439ef702cdeb86fdabe19e74559181553d9a21c82578e5ebc896cb36c448
MD5 17a2aedc8f4145d9453847fa52256602
SHA1 4a27f88675492cc73cda0a6cc5e39e6ce5d892c6
SHA512 62afd4439e36e7ef4320c900ef5d48842c0f54c79884a6aea9741fbfb250d772986a08fd0a8b2d4193fcb510e0b730045d6e97ac057b4860fdc876ab529eb3ac
SSDEEP 6144:meFbbrVLs9wz4ZoeETEW1gbpJA3KpSL0pDfDcCSGbO:melbRLs9ULePJA3KY0pMCSB
TLSH
T156845A43B7D400B9E5BE467848736615A73AB8218B72EBDF169404ED0E23BD2DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_17a2aedc8f4145d9453847fa52256602_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 396KB
- SHA256 bb62439ef702cdeb86fdabe19e74559181553d9a21c82578e5ebc896cb36c448
- MD5 17a2aedc8f4145d9453847fa52256602
- SHA1 4a27f88675492cc73cda0a6cc5e39e6ce5d892c6
- SHA512 62afd4439e36e7ef4320c900ef5d48842c0f54c79884a6aea9741fbfb250d772986a08fd0a8b2d4193fcb510e0b730045d6e97ac057b4860fdc876ab529eb3ac
- SSDEEP 6144:meFbbrVLs9wz4ZoeETEW1gbpJA3KpSL0pDfDcCSGbO:melbRLs9ULePJA3KY0pMCSB
- TLSH
  T156845A43B7D400B9E5BE467848736615A73AB8218B72EBDF169404ED0E23BD2DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution sheetrat persistence trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2