sheetrat | 8aedbf965e9b4ff3da5e21c00a219eefa91edc730192f4dca9acfa0c023b78d2

General

Target
2026-08-15_4832547849af8704d8041cb08bbb2088_amadey_darkgate_glassworm_icedid
Size 12.0MB
Sample260815-grkkxa1th1
SHA256 8aedbf965e9b4ff3da5e21c00a219eefa91edc730192f4dca9acfa0c023b78d2
MD5 4832547849af8704d8041cb08bbb2088
SHA1 e742ef9ba87ce6dc8898734713924c43610f61a3
SHA512 bb58cfbb08416578f6b8ced32362d74ad7eabf7548953c9525eba855d0ab838ed512665688e14e6dad419a83e994217b7d148feba913b524904416cb173919de
SSDEEP 196608:dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbW:dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbW
TLSH
T114C6D02438EF90E6CA71CABFE5D1DFB23631985049F48C26B1BC045FAD6BAD23592135
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_4832547849af8704d8041cb08bbb2088_amadey_darkgate_glassworm_icedid
- Size 12.0MB
- SHA256 8aedbf965e9b4ff3da5e21c00a219eefa91edc730192f4dca9acfa0c023b78d2
- MD5 4832547849af8704d8041cb08bbb2088
- SHA1 e742ef9ba87ce6dc8898734713924c43610f61a3
- SHA512 bb58cfbb08416578f6b8ced32362d74ad7eabf7548953c9525eba855d0ab838ed512665688e14e6dad419a83e994217b7d148feba913b524904416cb173919de
- SSDEEP 196608:dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbW:dbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbW
- TLSH
  T114C6D02438EF90E6CA71CABFE5D1DFB23631985049F48C26B1BC045FAD6BAD23592135
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2