darksiderat | cwelnigga[.]exe

Resubmissions

11/09/2026, 14:18

260911-rma6sathnh10

25/05/2026, 01:49

260525-b85phsdw8t10

15/05/2026, 11:31

260515-nm3n9acz4p10

Sharing

Copy URL Twitter E-mail

General

Target
cwelnigga.exe
Size 56KB
Sample260525-b85phsdw8t
SHA256 e32e2b488816bf70aba936221ea8e32f75dd2bdf7042e1516d53be347f2ae253
MD5 26121170fb2361f6ecf2a9ea411f095a
SHA1 f3a5e85af36b33a5129e64bcf957cf665ebdc33a
SHA512 0fc11297879a63a0ce0881074e781eeb76bad81cd7969b544bda0ba8714961c37a23ada881d25cda05f7ea729e4992eea375a6daa37055b2faecfd36bbafd740
SSDEEP 768:3UOXEihzbuqDg+lLifxYITmQznOWp54vg5d5YP98yxA1XbXqskW7rCVr8Z0kP:kcvu1ZdoWp0g5rBSm+pW7rCVoekP
TLSH
T135430935EA5AB06FD35DC874DE431D16CD127CCA87A4BB9B57910CD20EAAF209B2D381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan darksiderat

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
sample	family_darksiderat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cwelnigga.exe

File Explorer

cwelnigga.exe

.exe 56KB

cwelnigga.exe

IMPHASH 838ebf00106c790e199157fb51d61b1e
SHA256 e32e2b488816bf70aba936221ea8e32f75dd2bdf7042e1516d53be347f2ae253
MD5 26121170fb2361f6ecf2a9ea411f095a
SHA1 f3a5e85af36b33a5129e64bcf957cf665ebdc33a
SHA512 0fc11297879a63a0ce0881074e781eeb76bad81cd7969b544bda0ba8714961c37a23ada881d25cda05f7ea729e4992eea375a6daa37055b2faecfd36bbafd740
SSDEEP 768:3UOXEihzbuqDg+lLifxYITmQznOWp54vg5d5YP98yxA1XbXqskW7rCVr8Z0kP:kcvu1ZdoWp0g5rBSm+pW7rCVoekP
TLSH
T135430935EA5AB06FD35DC874DE431D16CD127CCA87A4BB9B57910CD20EAAF209B2D381
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects DarkSideRAT
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAStartup

crypt32

CryptStringToBinaryA

kernel32

WriteProcessMemory WriteFile CreateMutexA SuspendThread ResumeThread GetModuleHandleA Sleep GetLastError OpenMutexA InitializeSListHead LoadLibraryA CloseHandle VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory CreateProcessW FreeLibrary FlushInstructionCache CreateRemoteThread GetCurrentProcess CreateFileA ReleaseSRWLockExclusive SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime AcquireSRWLockExclusive TerminateProcess

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xout_of_range@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memcpy memcmp __std_exception_copy __std_exception_destroy memmove __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-runtime-l1-1-0

_exit exit _register_thread_local_exe_atexit_callback _initterm _cexit _register_onexit_function _initterm_e terminate _get_narrow_winmain_command_line _c_exit _initialize_onexit_table _set_app_type _initialize_narrow_environment _invoke_watson _configure_narrow_argv _seh_filter_exe _crt_atexit

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale