darksiderat | 98bba61d3b829cccc61ac023178e4fee69c144ffbb36d3f502fece27b2d69b65

General

Target
Unlock-All.exe
Size 1.5MB
Sample260803-l9y88svalh
SHA256 98bba61d3b829cccc61ac023178e4fee69c144ffbb36d3f502fece27b2d69b65
MD5 34dd13949f7dcda1b021a7320c7b515c
SHA1 f6ac8d3c1df00de850673a2d6e240797cea98596
SHA512 7524d2f80b5239688c024deb6dcac3d4204534d8de9847f20ba774acfc50a842fe3b722b2d315702e3b40137ec6d3a794f5934bd1332076201e0526e5c2167d5
SSDEEP 24576:U+AHEh9wnUfo4oW3YR5kRSoMCvzZnBTQu578TEfRb1bLwOMOfvC/WO93l0fZzabo:U+A09S74oZGBJzom78TEfRb1bLwOMOfh
TLSH
T10E75BF1AABA514F8C1BBC178C6568613E7B274190360DBDF06D096A62F33BD16F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Unlock-All.exe
- Size 1.5MB
- SHA256 98bba61d3b829cccc61ac023178e4fee69c144ffbb36d3f502fece27b2d69b65
- MD5 34dd13949f7dcda1b021a7320c7b515c
- SHA1 f6ac8d3c1df00de850673a2d6e240797cea98596
- SHA512 7524d2f80b5239688c024deb6dcac3d4204534d8de9847f20ba774acfc50a842fe3b722b2d315702e3b40137ec6d3a794f5934bd1332076201e0526e5c2167d5
- SSDEEP 24576:U+AHEh9wnUfo4oW3YR5kRSoMCvzZnBTQu578TEfRb1bLwOMOfvC/WO93l0fZzabo:U+A09S74oZGBJzom78TEfRb1bLwOMOfh
- TLSH
  T10E75BF1AABA514F8C1BBC178C6568613E7B274190360DBDF06D096A62F33BD16F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2