sheetrat | 36b88a7d0b120e40dde303ec9c140e1966bb2b67cfab04e36eb5eea6b5b53d50

General

Target
2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid
Size 6.0MB
Sample261027-b47cjscd75
SHA256 36b88a7d0b120e40dde303ec9c140e1966bb2b67cfab04e36eb5eea6b5b53d50
MD5 f870ad52708fa08374a4c20ef483580f
SHA1 8b04b9359851c6ac652832fe4a7c34a655852044
SHA512 c2e81a8b871d652e69b83d10c3f2bbdb198676675a158f94170a7cfffcdc9aae7af3ae2ff7920eee033153b400b3de4546416007d8fd4e8485e33fcfcd0103dd
SSDEEP 24576:egbxVOwV9UqPJA3VscJWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWh:zhPJAlXj
TLSH
T1FE56D0F161DE3AA3ED54D6BC414F7A68F27F74109F0AC1E8D898111D282436B4E7CA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-26_f870ad52708fa08374a4c20ef483580f_amadey_darkgate_glassworm_icedid
- Size 6.0MB
- SHA256 36b88a7d0b120e40dde303ec9c140e1966bb2b67cfab04e36eb5eea6b5b53d50
- MD5 f870ad52708fa08374a4c20ef483580f
- SHA1 8b04b9359851c6ac652832fe4a7c34a655852044
- SHA512 c2e81a8b871d652e69b83d10c3f2bbdb198676675a158f94170a7cfffcdc9aae7af3ae2ff7920eee033153b400b3de4546416007d8fd4e8485e33fcfcd0103dd
- SSDEEP 24576:egbxVOwV9UqPJA3VscJWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWh:zhPJAlXj
- TLSH
  T1FE56D0F161DE3AA3ED54D6BC414F7A68F27F74109F0AC1E8D898111D282436B4E7CA6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2