sheetrat | 6659bd8426629feb5b6b047be24ecd3cfdcc032016a9ab277d4da1e4d71420cf

General

Target
2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid
Size 3.0MB
Sample260908-mnes5sybnd
SHA256 6659bd8426629feb5b6b047be24ecd3cfdcc032016a9ab277d4da1e4d71420cf
MD5 f0fae61294f9f0a66ee60a203f4540f8
SHA1 9a96295b40c0f70d5767ec46b1853c5c39b538cf
SHA512 0983be39fa5204023ba25f0b0f2b769a5efe3552ce85211410ad4a414f1473731934a7a2012a6ad63a9ea367db128ce30fc11db206a7ba706d66caa9a562dbc7
SSDEEP 24576:1+z9UqPJA34BlAc52cccncccccccHI6keeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeP:wrPJAoTX+
TLSH
T172E5CF50F25388FEC1085675C57D43FC49B2B2886D1287837B5A942F990EBB8AD71EBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-08_f0fae61294f9f0a66ee60a203f4540f8_amadey_darkgate_glassworm_icedid
- Size 3.0MB
- SHA256 6659bd8426629feb5b6b047be24ecd3cfdcc032016a9ab277d4da1e4d71420cf
- MD5 f0fae61294f9f0a66ee60a203f4540f8
- SHA1 9a96295b40c0f70d5767ec46b1853c5c39b538cf
- SHA512 0983be39fa5204023ba25f0b0f2b769a5efe3552ce85211410ad4a414f1473731934a7a2012a6ad63a9ea367db128ce30fc11db206a7ba706d66caa9a562dbc7
- SSDEEP 24576:1+z9UqPJA34BlAc52cccncccccccHI6keeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeP:wrPJAoTX+
- TLSH
  T172E5CF50F25388FEC1085675C57D43FC49B2B2886D1287837B5A942F990EBB8AD71EBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2