darksiderat | ox_1773719692687[.]exe

Target
ox_1773719692687.exe
Size 79KB
Sample260620-wsajnahw61
SHA256 f63ee52cf8bc3a075eddddeaa198ddb3bff5adf3da41dcc68f28a4e1ca2cd506
MD5 416275bb02a22efbf68717c00046dee3
SHA1 c6042110b028c99644f5c2c849cbc98484e91708
SHA512 890ca2c2944fff7a373503a6574992b70984cac004c30e78b33cab5b7cc0cfca534470a41e1b6a875397f6b0bfdbfa21771d2ee82ec7405b3e99e81ccf3a471b
SSDEEP 1536:+KJry/hjDGlrjeNHK3xnmF/MbA9mFYVM0:BW/hDGl/eZblyAM+VM0
TLSH
T1E8832A35CAAEB07ED3299A78DD020D95CF63BC8A0794BF9753E10DE60F96A501F2C584
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan darksiderat

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 1 IoCs

resource	yara_rule
sample	family_darksiderat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ox_1773719692687.exe

File Explorer

ox_1773719692687.exe

.exe 79KB

ox_1773719692687.exe

IMPHASH 13202ae6e20dc0e6f8ae3713ee808076
SHA256 f63ee52cf8bc3a075eddddeaa198ddb3bff5adf3da41dcc68f28a4e1ca2cd506
MD5 416275bb02a22efbf68717c00046dee3
SHA1 c6042110b028c99644f5c2c849cbc98484e91708
SHA512 890ca2c2944fff7a373503a6574992b70984cac004c30e78b33cab5b7cc0cfca534470a41e1b6a875397f6b0bfdbfa21771d2ee82ec7405b3e99e81ccf3a471b
SSDEEP 1536:+KJry/hjDGlrjeNHK3xnmF/MbA9mFYVM0:BW/hDGl/eZblyAM+VM0
TLSH
T1E8832A35CAAEB07ED3299A78DD020D95CF63BC8A0794BF9753E10DE60F96A501F2C584
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects DarkSideRAT
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcp140

?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Random_device@std@@YAIXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Xbad_alloc@std@@YAXXZ

dxgi

CreateDXGIFactory

wininet

InternetOpenA

vcruntime140

memcpy memcmp __std_exception_copy __std_exception_destroy memmove __current_exception_context __current_exception memset __C_specific_handler _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initterm _c_exit terminate _configure_narrow_argv _invoke_watson _initterm_e _set_app_type _seh_filter_exe _cexit _get_narrow_winmain_command_line exit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _exit

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-string-l1-1-0

wcslen isspace strlen

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess

Resubmissions

Sharing

General