darksiderat | ca0f0b866ce6e9b2670931485f7fcebfa956f1d82a39e98cbb67254295d23dd2

General

Target
2026-07-06_e536ede56825fac3f59e610446bf57c9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
Size 5.1MB
Sample260707-anfdfsbt5r
SHA256 ca0f0b866ce6e9b2670931485f7fcebfa956f1d82a39e98cbb67254295d23dd2
MD5 e536ede56825fac3f59e610446bf57c9
SHA1 be25337c55bbf28174c9d0d0a6654ff085bb4066
SHA512 22dd62c1c4db0bf8c13bd6b0d0ee49deccf1d599596873cc8f7be951614ae5a0911303640f017b2713139478dd04a3ced13a34eaae0448478c93d05f111ba2d9
SSDEEP 49152:6OjPWkByrSzKQF8Xgqv7ihjYzZ38SPVUgQwfiAQlOGp83YXTNBN5ouVouxP+O3LC:FjaW038SPVKn7Fl+9XTP2LIj1eQm
TLSH
T1EC469D5663A401E8C5B7D178CA978627E7B27C061371C7DF02A0666A1F37BE1AE3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-06_e536ede56825fac3f59e610446bf57c9_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
- Size 5.1MB
- SHA256 ca0f0b866ce6e9b2670931485f7fcebfa956f1d82a39e98cbb67254295d23dd2
- MD5 e536ede56825fac3f59e610446bf57c9
- SHA1 be25337c55bbf28174c9d0d0a6654ff085bb4066
- SHA512 22dd62c1c4db0bf8c13bd6b0d0ee49deccf1d599596873cc8f7be951614ae5a0911303640f017b2713139478dd04a3ced13a34eaae0448478c93d05f111ba2d9
- SSDEEP 49152:6OjPWkByrSzKQF8Xgqv7ihjYzZ38SPVUgQwfiAQlOGp83YXTNBN5ouVouxP+O3LC:FjaW038SPVKn7Fl+9XTP2LIj1eQm
- TLSH
  T1EC469D5663A401E8C5B7D178CA978627E7B27C061371C7DF02A0666A1F37BE1AE3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Downloads MZ/PE file

Checks computer location settings

Deletes itself

Executes dropped EXE

Checks installed software on the system

Drops desktop.ini file(s)

Network Service Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2