darksiderat | 1374d47c40ac721529d40a99c8cb6a0c722f8993dc4bf5231e22ae3d7b3af1ce

Resubmissions

15/07/2026, 18:40

260715-xbb7lafv4t

15/07/2026, 18:01

260715-wlvk9aat8k3

15/07/2026, 16:07

260715-tkmg5sgs2n10

Sharing

Copy URL Twitter E-mail

General

Target
freestuffs.rar
Size 4.6MB
Sample260715-tkmg5sgs2n
SHA256 1374d47c40ac721529d40a99c8cb6a0c722f8993dc4bf5231e22ae3d7b3af1ce
MD5 aed00d6bf33e9d5adad3f33c67c7aa12
SHA1 7255539aa6da757a9be6407d36d0b66f4e261ebf
SHA512 2f78c1ab47df84ce70670011848265a567f2dc25bb0f185bad383bf4298ed0ecae204529cf25646fc7c2be04e5e87f0da114fbbb92ea759ea05306063d3d320f
SSDEEP 49152:U6kzQgHK60AgRQUNBVP7+riYj6JyXgUP7JzVnPP7tzVnxP7YzVnlP7tzVn3:USsdg+UNBIrBGyXXzVn5zVnGzVnfzVn3
TLSH
T12326331E5B1D1F7996E2F243DA8AF8A53FE0C5546F3F30D16A4A672E67C0B02D748844
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  freestuffs.rar
- Size 4.6MB
- SHA256 1374d47c40ac721529d40a99c8cb6a0c722f8993dc4bf5231e22ae3d7b3af1ce
- MD5 aed00d6bf33e9d5adad3f33c67c7aa12
- SHA1 7255539aa6da757a9be6407d36d0b66f4e261ebf
- SHA512 2f78c1ab47df84ce70670011848265a567f2dc25bb0f185bad383bf4298ed0ecae204529cf25646fc7c2be04e5e87f0da114fbbb92ea759ea05306063d3d320f
- SSDEEP 49152:U6kzQgHK60AgRQUNBVP7+riYj6JyXgUP7JzVnPP7tzVnxP7YzVnlP7tzVn3:USsdg+UNBIrBGyXXzVn5zVnGzVnfzVn3
- TLSH
  T12326331E5B1D1F7996E2F243DA8AF8A53FE0C5546F3F30D16A4A672E67C0B02D748844
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  freestuffs/AP.exe
- Size 4.5MB
- SHA256 b2c969f0a57aec05f3ed9eb676ba066f07fb4381dc0ae76d289631e4afc48ef9
- MD5 926bac80766e9ec3d36010b884d5ee3f
- SHA1 a7fd517517414afc1cd6840dbdd879f365f8866d
- SHA512 e99c6096bcfa8ebc2af153b721ab7f755e9f1a553af0f84b5ef87ea241446ff5b5aa0ca7e789facfd56c091db56cd26f601bebfb773dbd83c7ab668e41b53d6a
- SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWdHdVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIgSbs8J2o4GQE
- TLSH
  T16926F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution darksiderat persistence ransomware spyware trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  freestuffs/EU.exe
- Size 4.5MB
- SHA256 4e4a5bc54814a36edea4a4b3e88cf5af49a3fa9f9bfa7ede5fc03286c07616c7
- MD5 84406024256c6b92b357a15de6840103
- SHA1 5e3d7894e45b617a3b7dd31ba7be821b1ed852f2
- SHA512 d171c2d90c9376303c61a3c10e079fa2a3f9b2fe4324605ded086b53e7f4543aabf07d867d94482d2ad1b4ece34be99ad2840d048ae7e9e5e6eb74efd799b1ab
- SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWd0dVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIjSbs8J2o4GQE
- TLSH
  T1E126F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution darksiderat persistence ransomware spyware trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3
- Target
  freestuffs/EU.exe.bak
- Size 4.5MB
- SHA256 b2c969f0a57aec05f3ed9eb676ba066f07fb4381dc0ae76d289631e4afc48ef9
- MD5 926bac80766e9ec3d36010b884d5ee3f
- SHA1 a7fd517517414afc1cd6840dbdd879f365f8866d
- SHA512 e99c6096bcfa8ebc2af153b721ab7f755e9f1a553af0f84b5ef87ea241446ff5b5aa0ca7e789facfd56c091db56cd26f601bebfb773dbd83c7ab668e41b53d6a
- SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWdHdVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIgSbs8J2o4GQE
- TLSH
  T16926F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral4
- Target
  freestuffs/Internal MAGIC BULLET.dll
- Size 477KB
- SHA256 89190818555e0c9c445e925710cee9f88bc7d035d1c4a136d20f9a216895ab7d
- MD5 0f9604d1cc8643840e73e23b45e67083
- SHA1 1ba8e98f958425607a1e1efa4d87bd76d0b3f2f2
- SHA512 30615f464d43bab7ac7595aececf4a8a54db0d41c25d42fe4c54539f74890e34ac277413d8b23c65032da51c70f727ccba3140e7d462ff87d3232b507c7466e3
- SSDEEP 12288:KJq0bc62kQCLo7wBlZnbTX+wIGjn/dycm4khBSN:KJq04KH+wIidWhBSN
- TLSH
  T10BA46C1DA59602BCE172E4B45A725C13FA717C4E0764A9DB13E0CCB91F2ABD4A73BE01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral5
- Target
  freestuffs/NA.exe
- Size 4.5MB
- SHA256 0400be06069bcaf0dc6e30afb27a788920b1737411857321b01115e0ea76656f
- MD5 e7006d68be23b07892870dc55c247f37
- SHA1 50fecac76d0068698499fcff5bd3e62707d4a956
- SHA512 6fc11abdf06e695b44ebdfd797e6fe60b7ae40433ca069751ba901a556a4e3bc365137095137123e0afbf208c650823a349662414b5f2e1d76d866c525ea09b8
- SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWdTdVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIgSbs8J2o4GQE
- TLSH
  T12826F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution darksiderat persistence ransomware spyware trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  freestuffs/NA.exe.bak
- Size 4.5MB
- SHA256 b2c969f0a57aec05f3ed9eb676ba066f07fb4381dc0ae76d289631e4afc48ef9
- MD5 926bac80766e9ec3d36010b884d5ee3f
- SHA1 a7fd517517414afc1cd6840dbdd879f365f8866d
- SHA512 e99c6096bcfa8ebc2af153b721ab7f755e9f1a553af0f84b5ef87ea241446ff5b5aa0ca7e789facfd56c091db56cd26f601bebfb773dbd83c7ab668e41b53d6a
- SSDEEP 49152:fhZYKmP6MctN/cfNfdpMvZ7pNMD5TXhnAWdHdVdZdLdvdAdPd1bdUd77dud3dXpM:s6yNfPMvZIgSbs8J2o4GQE
- TLSH
  T16926F69329DB0CF5DED267B875CB22399734FD32CE681B2B9648C12469532C4BD2EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution darksiderat persistence ransomware trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7
- Target
  freestuffs/injector.exe
- Size 120KB
- SHA256 d72c7ca912266d1570135e9e58754342dac6d7d2e0384a47d042fc0486a4d0b4
- MD5 f267b6fa192ed3881b351e478764671d
- SHA1 a24514a67a524ad670554e33d084b88fe0368380
- SHA512 cd463c986514669022dd58a66675ad07bb10b4955afcd5f7f585bb19678bdd61121d392935b0272275986e0367d41bb9bf57630e94074c7ccac1ee89e6a87e69
- SSDEEP 768:vMW6uyteoJ+cMKEU1CfOYM7o+HZVN2S7AHv7k5PwyMtBu6LR:vM7teoJ+0Y5+ZySczk5Psru6LR
- TLSH
  T158C35B4AE7A904FDD0B6C17EC9631D95D673F8194761ABCF0390522A0FB23C09D3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Executes dropped EXE
behavioral8