sheetrat | ca8c2b32f4dad49187321099ce679dc7df29f68eded8b3e052be0375a5570815

General

Target
2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid
Size 13.0MB
Sample260928-c8faastclh
SHA256 ca8c2b32f4dad49187321099ce679dc7df29f68eded8b3e052be0375a5570815
MD5 94e639d588ae5028be6ce6a9c1b74145
SHA1 24bc396f304d07b863bcac34551784597efbf47c
SHA512 fd4001d597bbab9c80c496ffdd4d1bc62b5edaa46176a2f28ba41d2b5a4a71d75765971b3e5af908370b7c62db2130ba5ee0bf70313ccdf85242c001c622e975
SSDEEP 24576:ZbEqDfk9UqPJA3/rcbiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii3:lCPJAP3
TLSH
T1E6D6D0C447FA8B78DE1CE639B27B5909F7AD9CB828BF24CE52425C441EA1381EF5064D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid
- Size 13.0MB
- SHA256 ca8c2b32f4dad49187321099ce679dc7df29f68eded8b3e052be0375a5570815
- MD5 94e639d588ae5028be6ce6a9c1b74145
- SHA1 24bc396f304d07b863bcac34551784597efbf47c
- SHA512 fd4001d597bbab9c80c496ffdd4d1bc62b5edaa46176a2f28ba41d2b5a4a71d75765971b3e5af908370b7c62db2130ba5ee0bf70313ccdf85242c001c622e975
- SSDEEP 24576:ZbEqDfk9UqPJA3/rcbiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii3:lCPJAP3
- TLSH
  T1E6D6D0C447FA8B78DE1CE639B27B5909F7AD9CB828BF24CE52425C441EA1381EF5064D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation ransomware trojan exploit
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Modifies file permissions
  discovery
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2