sheetrat | 8d69f61a14793288c8cdeff80784ef050ebe2dd4f08bc951051725214e6e803e

General

Target
2026-08-24_039a948e3280cc439898d7cc94148e27_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 445KB
Sample260825-yxkarsej2v
SHA256 8d69f61a14793288c8cdeff80784ef050ebe2dd4f08bc951051725214e6e803e
MD5 039a948e3280cc439898d7cc94148e27
SHA1 2c935d7230d0a2a1de8d4ad21ba4868a01f97ca7
SHA512 acdbaee6ed0df278e747616fd64a1f2c7cee60768be293c98718c04b7eb76747a5c83211a279997afd7e042271da733630f2acc253a922c6313b7e454e9ac079
SSDEEP 12288:a8b5YWLKLPmhH9ULePJA3KY0pPJTDEpUW:Pb5jx9UqPJA3cJY
TLSH
T152A45A42B7D504B9E5BE863858735A14973AFC214B62EBDF168424ED0E32BC2DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-24_039a948e3280cc439898d7cc94148e27_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 445KB
- SHA256 8d69f61a14793288c8cdeff80784ef050ebe2dd4f08bc951051725214e6e803e
- MD5 039a948e3280cc439898d7cc94148e27
- SHA1 2c935d7230d0a2a1de8d4ad21ba4868a01f97ca7
- SHA512 acdbaee6ed0df278e747616fd64a1f2c7cee60768be293c98718c04b7eb76747a5c83211a279997afd7e042271da733630f2acc253a922c6313b7e454e9ac079
- SSDEEP 12288:a8b5YWLKLPmhH9ULePJA3KY0pPJTDEpUW:Pb5jx9UqPJA3cJY
- TLSH
  T152A45A42B7D504B9E5BE863858735A14973AFC214B62EBDF168424ED0E32BC2DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit sheetrat persistence privilege_escalation ransomware trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2