darksiderat | c6c82303c91963343576f224c1e79a5e71697b522876f15a1aff245334097800

General

Target
2026-07-01_b5c621d50134e454f2455f1e26585461_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig
Size 7.4MB
Sample260701-t773csav5p
SHA256 c6c82303c91963343576f224c1e79a5e71697b522876f15a1aff245334097800
MD5 b5c621d50134e454f2455f1e26585461
SHA1 5d755c66a48db8c008ab2db03b8143ae62580468
SHA512 d0f425d1374f006f8284bbfb7bc0c6467fdb7b95e031cbaf7b3747c74c8fa9995a53bdbcdcd41a46c0391eaca27bb5bc929c378d4ee49f5336ed00a992f8471b
SSDEEP 98304:V7a04zC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:d4zCt6cUIp+spiep70qHpNcjr
TLSH
T170767C57A29550E8C83BC178C6965233E7B2B8155330ABDF16A4E7361F33AE05E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-01_b5c621d50134e454f2455f1e26585461_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xmrig
- Size 7.4MB
- SHA256 c6c82303c91963343576f224c1e79a5e71697b522876f15a1aff245334097800
- MD5 b5c621d50134e454f2455f1e26585461
- SHA1 5d755c66a48db8c008ab2db03b8143ae62580468
- SHA512 d0f425d1374f006f8284bbfb7bc0c6467fdb7b95e031cbaf7b3747c74c8fa9995a53bdbcdcd41a46c0391eaca27bb5bc929c378d4ee49f5336ed00a992f8471b
- SSDEEP 98304:V7a04zC6Ob2cUl/6pRedsp/KepIKJaz3eHp+ee6Mjr:d4zCt6cUIp+spiep70qHpNcjr
- TLSH
  T170767C57A29550E8C83BC178C6965233E7B2B8155330ABDF16A4E7361F33AE05E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darksiderat xmrig miner persistence trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Family: xmrig

XMRig Miner payload

Downloads MZ/PE file

Executes dropped EXE

Contacts third-party web service commonly abused for C2

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2