sheetrat | ed48366b763272463cbd8cb06e78bf3a7812a9516ac737efadbeb434c8d4283e

General

Target
2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid
Size 420KB
Sample261109-2n6dese17x
SHA256 ed48366b763272463cbd8cb06e78bf3a7812a9516ac737efadbeb434c8d4283e
MD5 a34af1f055349fa824b392b83fec3cd6
SHA1 666a526a86c044f6d8e21d4d1cff4c5de07952a6
SHA512 c783fefc8a37f9e2fef87805da3d652b53e6acf801c55e763957db0222a15ebb2a2c2e300878d98c28ca038741b612b3df84300ceb436ee8045d6fe00730d504
SSDEEP 6144:MUNbnrMkBzb/11TaEC9wz4ZoeETEW1gbpJA3KpSL0pD1QNUb/sI:M4bnrMwzb/15aZ9ULePJA3KY0pSm
TLSH
T12E945942B7D504B9E1BE867898726614977AF8214B72EBDF168404ED0E33BC2DD34F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-09_a34af1f055349fa824b392b83fec3cd6_amadey_cobalt-strike_darkgate_glassworm_icedid
- Size 420KB
- SHA256 ed48366b763272463cbd8cb06e78bf3a7812a9516ac737efadbeb434c8d4283e
- MD5 a34af1f055349fa824b392b83fec3cd6
- SHA1 666a526a86c044f6d8e21d4d1cff4c5de07952a6
- SHA512 c783fefc8a37f9e2fef87805da3d652b53e6acf801c55e763957db0222a15ebb2a2c2e300878d98c28ca038741b612b3df84300ceb436ee8045d6fe00730d504
- SSDEEP 6144:MUNbnrMkBzb/11TaEC9wz4ZoeETEW1gbpJA3KpSL0pD1QNUb/sI:M4bnrMwzb/15aZ9ULePJA3KY0pSm
- TLSH
  T12E945942B7D504B9E1BE867898726614977AF8214B72EBDF168404ED0E33BC2DD34F62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution sheetrat persistence privilege_escalation ransomware trojan exploit
- Detects Sheetrat Payload
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Family: Sheetrat, NonEuclid rat
  Sheetrat aka NonEuclid RAT is a trojan written in C#.
  trojan sheetrat
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Custom signature
  
  Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Custom signature
  
  Detects executables (downlaoders) containing URLs to raw contents of a paste
- Custom signature
  
  Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates new service(s)
  persistence execution
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers new Windows logon scripts automatically executed at logon.
  persistence
- Stops running service(s)
  defense_evasion execution
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2