darksiderat | f9535b10e72de9b6149e69c2c7815d2b2773c6510786c6714344811719c9cea6

General

Target
2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer
Size 18.4MB
Sample260705-c8tspagx5x
SHA256 f9535b10e72de9b6149e69c2c7815d2b2773c6510786c6714344811719c9cea6
MD5 6d8d1db437c7b0090336165947df7689
SHA1 0721b491463aeb6602a6b7de4245b54cc92c4222
SHA512 c5a309162d19e40fecd23129314285dc51ca0c1e8cc05d85f9bd0be2338eef5f5ae1a214fa2954296936d87c44b2a6d21e149b93464c9aea870275fe924a983a
SSDEEP 98304:bAn5GsOIJdKWDLhkmiIIN0DJhIOtXNdi8hKJ3VGXkNEc3baVwT4xiPqy+4tYbZSU:boPPQXY98ENA4ARGYnq0J6
TLSH
T1A91708117B5B99ACC19AC8B0834A47774E2130DB0A36B9BF45D456393F6EBF42F28319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-05_6d8d1db437c7b0090336165947df7689_akira_glassworm_rusty-stealer
- Size 18.4MB
- SHA256 f9535b10e72de9b6149e69c2c7815d2b2773c6510786c6714344811719c9cea6
- MD5 6d8d1db437c7b0090336165947df7689
- SHA1 0721b491463aeb6602a6b7de4245b54cc92c4222
- SHA512 c5a309162d19e40fecd23129314285dc51ca0c1e8cc05d85f9bd0be2338eef5f5ae1a214fa2954296936d87c44b2a6d21e149b93464c9aea870275fe924a983a
- SSDEEP 98304:bAn5GsOIJdKWDLhkmiIIN0DJhIOtXNdi8hKJ3VGXkNEc3baVwT4xiPqy+4tYbZSU:boPPQXY98ENA4ARGYnq0J6
- TLSH
  T1A91708117B5B99ACC19AC8B0834A47774E2130DB0A36B9BF45D456393F6EBF42F28319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery trojan darksiderat
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Detects executables containing URLs to raw contents of a Github gist
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Detects executables containing URLs to raw contents of a Github gist

Executes dropped EXE

Checks whether UAC is enabled

Contacts third-party web service commonly abused for C2

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2