darksiderat | a84e2b5ab827b6587960bf6dfb4c16283fe493ad2d2b68e131467bd363ad2e71

Sharing

Copy URL Twitter E-mail

General

Target
Dimmi.zip
Size 152.5MB
Sample260604-s2vdmsaw2j
SHA256 a84e2b5ab827b6587960bf6dfb4c16283fe493ad2d2b68e131467bd363ad2e71
MD5 045d94f0f8365a5b3d9e840d95eb5f74
SHA1 bb624d614c1d6ed1bc3176fb46bf47c6a026871a
SHA512 adbbecf22057cf9118205885748bc1247fbb68616aca27277ae1c93b52c509745c1ece2c5d22a6926dbe8456d2a9e8fe93de18044219bbdfbcdbfa4b1a5f9ecb
SSDEEP 3145728:L8N6veYF3EuGuifaclwd51PNH2/fKTHOguyLppYJXhzDW0rznNLIWYGRpNYI:L8N6WuZefacur1PJIKTHJcJXhnWWRLIq
TLSH
T14A7833ADED7A168A5437D2B34FE75D6A85A20E6C0085B07F0C081DDF5A977E3E1FA402
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Dimmi.zip
- Size 152.5MB
- SHA256 a84e2b5ab827b6587960bf6dfb4c16283fe493ad2d2b68e131467bd363ad2e71
- MD5 045d94f0f8365a5b3d9e840d95eb5f74
- SHA1 bb624d614c1d6ed1bc3176fb46bf47c6a026871a
- SHA512 adbbecf22057cf9118205885748bc1247fbb68616aca27277ae1c93b52c509745c1ece2c5d22a6926dbe8456d2a9e8fe93de18044219bbdfbcdbfa4b1a5f9ecb
- SSDEEP 3145728:L8N6veYF3EuGuifaclwd51PNH2/fKTHOguyLppYJXhzDW0rznNLIWYGRpNYI:L8N6WuZefacur1PJIKTHJcJXhnWWRLIq
- TLSH
  T14A7833ADED7A168A5437D2B34FE75D6A85A20E6C0085B07F0C081DDF5A977E3E1FA402
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Dimmi/Core/cheat/Config/config.h
- Size 35KB
- SHA256 58cc7b70c6e68e22b8be0d45bbe32115aa931bff60bf8b9e7d4fb9bd84259861
- MD5 0fcb822ab4a0ca0d7bad583a995a158d
- SHA1 9cf33d9a4bd9a29a631f949ba56d3b68cb542985
- SHA512 8da03a8b007c8ea483b6dfc4093f73215ef948f8628b6505434aa43c93b647416f595e5e92bd38ac3a292621ad5e19acc5a16abc100a49cb54f2a4db78b8e343
- SSDEEP 768:j86ooOtpUL6NPFhhXugWc9Z1pUIejkdwLcUdT6WltE+md:Y6wtGLuujkMrmd
- TLSH
  T13BF2BB54966522BF0833577DCE9B9781FB13982750B1C375BEAF89082FF88904264EF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Dimmi/entrypoint.cpp
- Size 13KB
- SHA256 c8ad4e2f141c4b631481727eece8705d984758004b6febe36bc4e2109aae1d0f
- MD5 993d17d5130aa64e505e46043ea6ce1c
- SHA1 2c71d79c4bb1b879a4c83c7a3449f7d5c0bc447b
- SHA512 7dd4cd21894ce84fe2fc3237ca86e8f1aa8079115ebb40bc6753e29e32ff2c1699a4ca958e640c0797bc5a58e51bab9d9097a90bc70a6ea5f8da588e383a4cae
- SSDEEP 192:Wb4fbvBS1py3gPwLi4+Pyze9Gh++u2f8vukmffZJ+MAozpFF1up:Wb4fbvM1phwe4/eIju20Gk0HBpFF14
- TLSH
  T1A652C65318E9A9254877172BCB134006FA97762363209760FEDF828C6F71754E2F2EB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Dimmi/x64/Release/Dimmi.exe
- Size 998KB
- SHA256 671e568257ab7ac831652ccbdc4ec66d2c1665684993019a8c20fbea914da094
- MD5 48027c48618dde7a151a4ce51d764eaa
- SHA1 bafafc7e1a77257866ca919343b71d3e239b52f0
- SHA512 274d854ae662d9d6548f6d4bb2c2d50edbe1dd3c61f582f42c653b5213d1d772048cd6fb2abf962693999d8d89c1337f96c903936bf0d67cf81c80ab9da1d550
- SSDEEP 24576:ImiGd9olVga/0zfmYpiknYMDQLG/3dh+YW2:vuV9wmhknYLAh+z2
- TLSH
  T1A825CF45F7F441F8D17B9079D4A6AB1BFA3678480B308ADB23E445682FA77E04B76312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral7 behavioral8
- Target
  Dimmi/x64/Release/Dimmi.pdb
- Size 5.3MB
- SHA256 61635d87decf7eae428a581a389f493ffbc2211991d0492c9d1dff20f68f3870
- MD5 9762e067899d1ecb1797dbe5acd4ea38
- SHA1 678b47344409a83eaf62deba664fbdeef8e950af
- SHA512 1fdc287ad5a8827e99063e8a1e8ee9ea8b2358ed154dc5096ef0ac3fbacf9b0ed0067069e516babdab882a9aa5cfc59fc0328284044e11a2677c8946a8ab6738
- SSDEEP 49152:COdMkCjE5pUI0wsavieSikQYyyydaNgkxJyEng2diQpATIJv+hcw+MHeUFg64CX8:7h0wsa0JJl+hcwIU94peLk
- TLSH
  T180464BA2A3454D23D8BF1339A1971B1C636599029BEF77C7854EE22C9CC5348DF2FA81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  Dimmi/x64/Release/Spoof/Cleaners/clean.bat
- Size 23KB
- SHA256 32a7d5a22994abe3d74849a050197d5d220de8022b67142cec9978f7a97d7fdd
- MD5 71fc09e0d10fac106944f442675b62d1
- SHA1 1836d4f8e2f06c94a781d05b01d902c85629c8ba
- SHA512 525484044bc285012b9b59ace78bcd051825f1e21fe75c70b5e02f541d64e973290cc622e0a00adf040d934416c260be71b672a086926847458beb8d3c11e486
- SSDEEP 96:TufbN390uVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg51h:gMZifinifILh9aswTthIIhUY
- TLSH
  T182B29FA1BFD1E237AD5B411E037EDF0A45AC8C89128512702772BE49E24E43C65F1EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Dimmi/x64/Release/Spoof/Cleaners/clean1.bat
- Size 579KB
- SHA256 9fa1a9cb82e9731cba045d93ce8720a78eac7e48e0c88c1a76f46e3536a2341e
- MD5 5512c5dce702c3564581f40032ef877c
- SHA1 3c3b98500b82df4ebfb80bfd20c7399ef029f2d5
- SHA512 9541dec6b3fe149c24065d481e21f3943d94646b6b7ccff31643a70a1e2c6f89272a5047e63d49dfac9e07aba9dd5b4215544a6a04b1fbfdd197db7017f6cbe8
- SSDEEP 1536:iYLmcHjAkpYLmcTzg8gxDRnvplQL5LvLpLjLwazhztzhzo:iYScHNYScTzg8glRnvpWzhztzhzo
- TLSH
  T162C4654027248011D5B3364DE66FB8296F6DF18F71E06AC711EEBB0DD89B91CC2752EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  Dimmi/x64/Release/Spoof/Cleaners/clean2.bat
- Size 265KB
- SHA256 a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35
- MD5 ce55c0703b6be160771e927ba9de028f
- SHA1 144d8889c6d21de0121e189ff3a3d9f607875faf
- SHA512 a71678d1aa93a98c82721b351bb52aa339d374070aa85bb2a5782ee499823234d9bfdca1736c14dcba3626365059798275a6e55864cb7253a1895c91e4b82fdf
- SSDEEP 1536:gwNoZxBOz2oofaCWfr3PwUWgM8361L5LvLpLjL5Gzf4oH9Gzf4gH9c:gLfaCWcUWgM+4oH9q4gH9c
- TLSH
  T1F744B0926219A632E867108CC3EF855E38B8D08615E137B251F5EE0CD98B83C557BEF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Stops running service(s)
  defense_evasion execution
behavioral15 behavioral16
- Target
  Dimmi/x64/Release/Spoof/Cleaners/clean3.bat
- Size 22KB
- SHA256 8e43a6e232e9842777d3fce8c552bf942359757e6af092595c98ae101ee0e94d
- MD5 fbd3ebe26a823f86ae2deed72df613b9
- SHA1 ac360161007807aff1577ca90edc57b21c3d14c3
- SHA512 2def0b5306711a7806cdfe58196877cda39f3b0bcc5786776d9164f28310dfd85cbf922dc1619f2bba3dfa5c84a5701d1b948042e0af28b6af5c4c893ce045f5
- SSDEEP 96:tVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg51fH84f/vWo:KZifinifILh9aswTthIIhU0
- TLSH
  T175A28FA1BFD1E237AD5B421E037EDF1A45AC8C49128412702772BE49E28E43C65F1EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Dimmi/x64/Release/Spoof/Cleaners/clean4.bat
- Size 1.4MB
- SHA256 4eccca4eba74d76934827596ec0c7b2bc0f7db149dfc5fb1bb5cf8a4f4b7cf79
- MD5 49f9f195b3c0bd82a2b5bcfef94be391
- SHA1 4be260b5bd5d442c39b9cb792f1ffba09d851df9
- SHA512 e612bc43843f9b244c89418be49f460240cf78c1aeb050b60af2f3867f25eb5db86f15841ce90daa99fc69ef9c5e0d144d0afaada8dbd92a30e4269a9971e392
- SSDEEP 12288:tcFSOojunYATI9sMrPkuipWvDIkORU14n7:eFSOojunYATI9sMrPkuipWvDIkORV7
- TLSH
  T197657400A2259272D4A321C8D3DF991D39BCD18732A07B9352E56E4DDC8E83C557FEEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral19 behavioral20
- Target
  Dimmi/x64/Release/Spoof/Cleaners/clean5.bat
- Size 23KB
- SHA256 ece85e106e3cc7564ce27dca5e91cab74a871713b9aff810bc74e4a4bf4e893d
- MD5 0eecf30d9019528a4d92ba6d4579d178
- SHA1 611d56f205f8870494e12b0000e19ebbfff24c72
- SHA512 4a3d1d8b6f2ff32978cedf7b934c403313960907bca6d4308dfdaf8dab2464f6cbb19750b5a8f114904df774e0f7c2f0ff2d4e89135156d9485ff5e2ed3a264c
- SSDEEP 96:TufbN390uVeN1ZifiB1ifIXi4C4AySST5bWV7oJnJdwTK4hS9X4V4j4V4z5Rg51Q:gMZifinifILh9aswTthIIhUV
- TLSH
  T169B29FA1BFD1E237AD5B411E037EDF0A45AC8C89128512702772BE49E24E43C65F1EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Dimmi/x64/Release/Spoof/Xeno Free Temp V4.exe
- Size 2.6MB
- SHA256 53f61e904202473521edc16413635c9ab6cb2ac2c62b786897991b41e04efff3
- MD5 47a4d33751c0227b7b45dbc5de48bb4a
- SHA1 3c1f545097f4c32caabc24092ed48f8ffbe37f45
- SHA512 798b8ee042088a605e52064d336a0b2d569eafa0aa0a1fc30169ef80c0eb7f689c4705483effcf0769c95faa98870ec1e0e166ea58dc45b9acfdb3a5db2ff521
- SSDEEP 49152:5CvZzh5nFxp0ypr3ken/kG80pkzXDUcyaVGiTyenJQp2emG0Erv8nFJSE5Lyw:5CvZF+w2t22/
- TLSH
  T1BFC58DC3ED534AD9E386EB7865623317B96A336A0B38C6FF15D41D626A073C0066734E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral23 behavioral24
- Target
  Dimmi/x64/Release/Spoof/serials checker.bat
- Size 3KB
- SHA256 8db2bbfba77ff09b46b285eec3b8c6ce2edc2f610b386af73c0012dc269e4bfb
- MD5 b330674b0d42c5d5a7f6b802803b63e0
- SHA1 f659ce303aba9122dad750448f652bad489e3df7
- SHA512 971bdaf5de960c51bd257e78e788a1011586295a15fa9cfa47986a07a560908c17596808adb3dcbc40e4bce090217c31bddadde8d270729feb5a3c948f61059e
- TLSH
  T13A814392B4565027C0F8AEB18B344112F819998746282ECCB83FC2B45FB67D47BFD68D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Dimmi/x64/Release/obj/AbdiWorking.exe.recipe
- Size 326B
- SHA256 d24e8f4c0375ed73a3c16d8b2b711fa88d8867fd094be5045be88f830e7d8d4b
- MD5 0243e811e8f7929946d3dce0b3577ef9
- SHA1 dea6f46ad895b5924d49495e5b5b04980e4d7b2a
- SHA512 66a0a359ebb3b24f7ecd5a5c096623d87935453e069e9f5b592c90eed22ee5d400c96f848c28b7b0493b2995ab997e08d3b64da1000b2baf934f4941d1d6fb81
- TLSH
  T1C4E08CAA5880F45667B09111D67EAF69FB9EBAD34A240CA13484CDAB0E9B44440434B7
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Dimmi/x64/Release/obj/AbdiWorking.tlog/AbdiWorking.lastbuildstate
- Size 187B
- SHA256 dd3ddeef812cd4d8bc4f3bfe8969105cc250107e79970d321d9f38bf133434bc
- MD5 1114b8daa7cc5648a3b7fc0a8264c5b9
- SHA1 d9aaae459c16c33f10b0f035fdf4e9578eeb4417
- SHA512 104f4db1b5383e4b09801ed06f25202a69aa3f0e4261b194fae63c4826cb058c5cd5983370d35b986bf7e8777c9bb8e091e766954395dcf263fdec426fcd89e4
- TLSH
  T148C0C044222086F76011740644D0468C23EC7273CC65F08C4C411F1C1F9D80840D3133
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Dimmi/x64/Release/obj/Dimmi.exe.recipe
- Size 313B
- SHA256 dd6a3ad4e16d48f9c38c6be2c3512fa8873699b9ed3233f940877880edfea2e1
- MD5 a2cfb82eb0776d55a094d7ce21a3a59b
- SHA1 583861e0285da6cab7b5dc1b7085b714078cb0fb
- SHA512 953f35b3097f74b57b70b87c1ae2b6e1efd0cafb84794239576ef464bd4b1162a25231c0d66ce4204a444d4bcc18edb831a9ec74e8282dec37ed05c5cc9c663e
- TLSH
  T186E08CA65884E046A7B05155D26D8F6AF70ABE874A304CA13490CEAB0E9348440034A7
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32