sheetrat | 5a6d35a355a8d82ce3754cb4b6c777eb57eee46358fd6f1d99d0ebda90e27757

General

Target
2026-11-01_d5643bf2da344daaff9d86a0c1cc2e74_amadey_darkgate_glassworm_icedid
Size 19.0MB
Sample261102-jb73daas3p
SHA256 5a6d35a355a8d82ce3754cb4b6c777eb57eee46358fd6f1d99d0ebda90e27757
MD5 d5643bf2da344daaff9d86a0c1cc2e74
SHA1 37ea0c81f4297fee6c75b626242a6c35c49c3c21
SHA512 60821e71b1b450f2017dd331fef0987b56804e69fd6c410827adef8d1408fbe2575a3ef39c630bb8474bf8d807d0bb15e20f24892bb2ca9e49e8be1898218d35
SSDEEP 6144:wxEfKF9wz4ZoeETEW1gbpJA3KpSL0pDNCKb:wxEfa9ULePJA3KY0p4
TLSH
T1CC175A43BBD000BAE5BE453844735619A73AF8119B62EBDF169404ED0F26BC6DD38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-01_d5643bf2da344daaff9d86a0c1cc2e74_amadey_darkgate_glassworm_icedid
- Size 19.0MB
- SHA256 5a6d35a355a8d82ce3754cb4b6c777eb57eee46358fd6f1d99d0ebda90e27757
- MD5 d5643bf2da344daaff9d86a0c1cc2e74
- SHA1 37ea0c81f4297fee6c75b626242a6c35c49c3c21
- SHA512 60821e71b1b450f2017dd331fef0987b56804e69fd6c410827adef8d1408fbe2575a3ef39c630bb8474bf8d807d0bb15e20f24892bb2ca9e49e8be1898218d35
- SSDEEP 6144:wxEfKF9wz4ZoeETEW1gbpJA3KpSL0pDNCKb:wxEfa9ULePJA3KY0p4
- TLSH
  T1CC175A43BBD000BAE5BE453844735619A73AF8119B62EBDF169404ED0F26BC6DD38F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution sheetrat persistence privilege_escalation trojan
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2