sheetrat | b5d9d546e96b16844002c7eb4d7556bb3848d7a8f02876ae72bb040dcb24e2e2

General

Target
2026-08-09_a1ce6833b04bbdfe7bbcbdd94711d9f1_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 420KB
Sample260809-ly3saavgjf
SHA256 b5d9d546e96b16844002c7eb4d7556bb3848d7a8f02876ae72bb040dcb24e2e2
MD5 a1ce6833b04bbdfe7bbcbdd94711d9f1
SHA1 b82f8eb8e7fc73bb3b8f9635b776726f8a0b960a
SHA512 55197b3bba8b1b6f2462d65326db060a020c00448a94ee520d1f5d13e8d73a9292c2a3985d471d6688563b1221a9c34a2e03d1dfaa4a5dbe02e294e09505ec2f
SSDEEP 6144:pUxblyCekVZxSTDDC9wz4ZoeETEW1gbpJA3KpSL0pDDFtcBHiUbFNh:pMblyCekVZUTDO9ULePJA3KY0pVtcBCW
TLSH
T1E2945903B7D504B9E5BE867848726615977AF8214B72EBDF169404ED0E23BC2DE34F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-09_a1ce6833b04bbdfe7bbcbdd94711d9f1_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 420KB
- SHA256 b5d9d546e96b16844002c7eb4d7556bb3848d7a8f02876ae72bb040dcb24e2e2
- MD5 a1ce6833b04bbdfe7bbcbdd94711d9f1
- SHA1 b82f8eb8e7fc73bb3b8f9635b776726f8a0b960a
- SHA512 55197b3bba8b1b6f2462d65326db060a020c00448a94ee520d1f5d13e8d73a9292c2a3985d471d6688563b1221a9c34a2e03d1dfaa4a5dbe02e294e09505ec2f
- SSDEEP 6144:pUxblyCekVZxSTDDC9wz4ZoeETEW1gbpJA3KpSL0pDDFtcBHiUbFNh:pMblyCekVZUTDO9ULePJA3KY0pVtcBCW
- TLSH
  T1E2945903B7D504B9E5BE867848726615977AF8214B72EBDF169404ED0E23BC2DE34F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2