sheetrat | 3a0e54dec6b90287d7bc8a34545cb804efbc78dd7ed61f362d1fd98d1e236a95

General

Target
2026-09-06_658661973bf168ee43c7bcab2899f7ca_amadey_darkgate_glassworm_icedid
Size 25.2MB
Sample260907-cgppnavsgt
SHA256 3a0e54dec6b90287d7bc8a34545cb804efbc78dd7ed61f362d1fd98d1e236a95
MD5 658661973bf168ee43c7bcab2899f7ca
SHA1 067ecef81e195de6feea448178c60cc8677129d1
SHA512 42cb081af8960a8046321df4ed26f5c4ec9ccd7951efdce9e2bb62ad71f733af438825d779d610e55f8c718ea0d8888db2cd1b6adade75d1220b9bb8a3d213e3
SSDEEP 49152:UgPJAsBXQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ5:UkW
TLSH
T1FD471235C50EAA6CE2AEB77084BAFDFD42E95EE31FC60AAF40DCAD433914151A12D744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-06_658661973bf168ee43c7bcab2899f7ca_amadey_darkgate_glassworm_icedid
- Size 25.2MB
- SHA256 3a0e54dec6b90287d7bc8a34545cb804efbc78dd7ed61f362d1fd98d1e236a95
- MD5 658661973bf168ee43c7bcab2899f7ca
- SHA1 067ecef81e195de6feea448178c60cc8677129d1
- SHA512 42cb081af8960a8046321df4ed26f5c4ec9ccd7951efdce9e2bb62ad71f733af438825d779d610e55f8c718ea0d8888db2cd1b6adade75d1220b9bb8a3d213e3
- SSDEEP 49152:UgPJAsBXQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ5:UkW
- TLSH
  T1FD471235C50EAA6CE2AEB77084BAFDFD42E95EE31FC60AAF40DCAD433914151A12D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies service settings
  Alters the configuration of existing services.
  defense_evasion
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2