sheetrat | 435b67657ef6690181c77a04c1038757cfd462d0ba07efdc57a8145bd991ec45

General

Target
2026-09-07_7c6c6c7d8254d6fc2d5abb2cd7d00647_amadey_darkgate_glassworm_icedid
Size 26.0MB
Sample260908-2b4dasysfv
SHA256 435b67657ef6690181c77a04c1038757cfd462d0ba07efdc57a8145bd991ec45
MD5 7c6c6c7d8254d6fc2d5abb2cd7d00647
SHA1 1241e22e579c7074efd162da7cb134164a17588b
SHA512 e6b488d30ad8d01133c7c8ba2e9fc62a00516fc5b2b20ea5878a566aa1e66a277557486c638b1e27badafb1f32321963740dc174bcc2e1ae8e16eb4bd670bd44
SSDEEP 49152:UgPJAsBXQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ5:Uk
TLSH
T1B7571235C50EAA6CE2AEB77084BAFDFD42E95EE31FC60AAF40DCAD433914151A12D744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-07_7c6c6c7d8254d6fc2d5abb2cd7d00647_amadey_darkgate_glassworm_icedid
- Size 26.0MB
- SHA256 435b67657ef6690181c77a04c1038757cfd462d0ba07efdc57a8145bd991ec45
- MD5 7c6c6c7d8254d6fc2d5abb2cd7d00647
- SHA1 1241e22e579c7074efd162da7cb134164a17588b
- SHA512 e6b488d30ad8d01133c7c8ba2e9fc62a00516fc5b2b20ea5878a566aa1e66a277557486c638b1e27badafb1f32321963740dc174bcc2e1ae8e16eb4bd670bd44
- SSDEEP 49152:UgPJAsBXQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ5:Uk
- TLSH
  T1B7571235C50EAA6CE2AEB77084BAFDFD42E95EE31FC60AAF40DCAD433914151A12D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2