Loading malware…
NonEuclid RAT is a Windows remote access trojan written in C# for the .NET Framework that provides attackers with unauthorized remote control of compromised systems. It is also referred to as SheetRAT, LiberiumRAT, and ShadowRoot. The malware combines conventional RAT functionality with extensive defense-evasion, persistence, and privilege-escalation features, and some reporting attributes additional botnet-style capabilities to it.
Observed behavior includes establishing command-and-control communications over TCP, maintaining connectivity through repeated reconnection attempts, and preventing duplicate execution through mutex use. NonEuclid employs multiple anti-analysis and anti-detection mechanisms, including AMSI bypass, attempts to weaken or evade Microsoft Defender protections, anti-debugging, anti-virtualization checks, dynamic API resolution, and process monitoring intended to identify and terminate analysis or administrative tools. Some reporting also describes the malware as including rootkit functionality.
For persistence and elevated execution, NonEuclid has been reported creating scheduled tasks, configuring autoload behavior, and using a User Account Control bypass to launch secondary components with higher privileges. It can also mark its own process as critical to complicate termination. Additional functionality reported for the malware includes enumeration of multimedia devices and ransomware-style file encryption using AES against selected file types.
NonEuclid has been promoted in underground communities and discussed on social and messaging platforms, and it has been characterized as affecting both individual users and organizations. High-confidence reporting supports Windows as the primary target platform and identifies the malware chiefly as a sophisticated RAT with strong emphasis on stealth, persistence, and post-compromise control.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
NONEUCLID RAT is equipped with features such as a rootkit, autoload functionality, and a User Account Control (UAC) bypass.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned in the malware/tools list only.
Named variant mentioned only as an example of a distinctive huntable name.
C#-based RAT with UAC bypass and AMSI evasion techniques to maintain unauthorized remote access and evade defenses.
A C#/.NET 4.8 remote access trojan that provides unauthorized remote control, persistence, anti-analysis and anti-VM checks, AMSI/Defender bypass, process-killing of analysis tools, scheduled-task and registry persistence, dynamic DLL/API loading, privilege escalation/UAC bypass, and AES-based file encryption that appends the .NonEuclid extension.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.