darksiderat | 3775cc17fb086a0093010b14797e90a4babc6c257ea83378d2685d2b603f17c7

General

Target
void,matrix for noctis.rar
Size 2.1MB
Sample260803-mwpy3sw1ew
SHA256 3775cc17fb086a0093010b14797e90a4babc6c257ea83378d2685d2b603f17c7
MD5 e97c4025c28d0f3eacd2c47de89e71e1
SHA1 4fcb9e8024e3fcdc6a52bf4c681328c6461d24cf
SHA512 9e2d26376402791b7c292dc82461692e33d5c36e47690a4f063f059d78fd339ead4a9a64ed94668617cf1d31747f6ca08382f92a36d570ee188428343db258f5
SSDEEP 49152:lb2jjw7BINO+L6NUWJ3C9Cj69z3D5JGaSPh5R1ETxnc:IjUVMO+LGUWBjazHGjP11ETxc
TLSH
T177A5337ACED62272B1901220567D9EEA46D1A3E8D4B75BD7348E9D63F50B0D72333B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  void,matrix for noctis.rar
- Size 2.1MB
- SHA256 3775cc17fb086a0093010b14797e90a4babc6c257ea83378d2685d2b603f17c7
- MD5 e97c4025c28d0f3eacd2c47de89e71e1
- SHA1 4fcb9e8024e3fcdc6a52bf4c681328c6461d24cf
- SHA512 9e2d26376402791b7c292dc82461692e33d5c36e47690a4f063f059d78fd339ead4a9a64ed94668617cf1d31747f6ca08382f92a36d570ee188428343db258f5
- SSDEEP 49152:lb2jjw7BINO+L6NUWJ3C9Cj69z3D5JGaSPh5R1ETxnc:IjUVMO+LGUWBjazHGjP11ETxc
- TLSH
  T177A5337ACED62272B1901220567D9EEA46D1A3E8D4B75BD7348E9D63F50B0D72333B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery darksiderat spyware trojan upx
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  Craftrise hilesiymis/libcrypto-3-x64.dll
- Size 5.1MB
- SHA256 b9b8651571ccef896776b99610c4d1385e14a8f2a2ebe70c8286fb426579e7be
- MD5 eb3340b72107ad708e415615805daef7
- SHA1 b2d53411ef2fc5c205764eb02d35ff0beda258f0
- SHA512 70d174f4d99606ec9855a54f5439b4870fc005f9bdf89ab5c38cca7a62120a92b3d60eb918184f0abbc872ed392c5c65c7956d03a149cbf0174022a9914b2ff9
- SSDEEP 98304:d2fp+Zkc3kJQfk0A15o9Q+y1CPwDvt3uFlxCC:d2fp+ZNkJQfk0A1eWf1CPwDvt3uFlxC
- TLSH
  T11E368C69B6BC0055E87A81BCC2836227EB71B92563B057DF5E6846F50F23BD02B7E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Craftrise hilesiymis/libssl-3-x64.dll
- Size 850KB
- SHA256 fc7dca9100f90e22cf98a5c7e90754318bae28289c3ac45bde0dcacd497de53f
- MD5 c0a2337d42e9add847813bc3d314c23e
- SHA1 c3369f86fc0b732f1f431ef8fa8f38c624fbde18
- SHA512 2ebaed6940ac485df6118dc3233572cfc10db8247a8e5479f6816b60fdc26fb749ab450a6074ff17104338c9a139f7a8aa480e3ae7ef54fc7a5a28d856db2a25
- SSDEEP 24576:Wxv2P0vxaJdOQEWTUwnPQgyC72NOUA4d:WxvP5aJdOegaUC2NOUA
- TLSH
  T193054C65FBB8009CE862D17C86934613D6B6F4163370EBEB1B648A392F637E1263D354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Craftrise hilesiymis/loader (4) (1).exe
- Size 248KB
- SHA256 1a0d9522d751c614505816dd97d2118ac109d48511e488fa5692960545c1b96f
- MD5 5d84978c4b96fb2d859137a79ffbdc26
- SHA1 d351fa395f3b8d280bb40b2ee40689b02424ce25
- SHA512 277be03c7a81667f3ff4b0ab2f7db19ef7ec3bc2b4c0db881b353fa35001f35b74edccdf630ca1e4a8e75cfa6017e1931c36bcf934afeb397777ca12ce677b36
- SSDEEP 1536:jomNUW96NL4sn3VSQmI8UkP+csdY5+ZySczk5Psru6LR:MK3yL4ggQmI8UkPThyySczk5Eru6LR
- TLSH
  T10A44CF47A72A04ADC0B2D57FC6971DC5D27234A94792ABCF0350526B1F73BC0AA3AB53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral4
- Target
  Craftrise hilesiymis/patcher.exe
- Size 568KB
- SHA256 3c54bac0019c59c86c25878d5f151b269254f5387ef573f457093f905ee9df97
- MD5 0866a95f5b8b70b01463e457659b47d2
- SHA1 4915cde5a21c8bb0269e66fb4fa754b68e726b32
- SHA512 21f0e2cda169f0840e58269058985da2dd8378bb66edfc9af5fd1bf5cc6fe71a25973ef65fbb2b75ecbdd95ae337f0946bf290afd8178abd66aaea6bf9498790
- SSDEEP 12288:Gpe2K3Vp2/gWHbqIQ7822R2vFhVEoVXL44VyFczYEj:GI2EVpoLOs2hyoVXL44VywD
- TLSH
  T15EC43B27EA1400EDD1A7C2FCCAA78D02F771B89A0362ABDB0391E5751F575E45E3EA10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10
- Drops file in Drivers directory
behavioral5
- Target
  Craftrise hilesiymis/server.crt
- Size 1KB
- SHA256 e22e924d57141a66d82370a611d9463cc28640585ec8edecd4c9aba962e897b5
- MD5 b364c0b8f5422577936291c685348674
- SHA1 b1dbf3f47e92225d32f9ed3edc6cee493c67fee9
- SHA512 8c1ec3c5fdcc6ceee0f615239b1a316fae0648b63ea28693b86026dc23ea110ce4d38e84cd06913b941db2a0bd95e9f0a297bc8f8c4c6045b546447a4456cf11
- TLSH
  T1D421C6CE0BA0A968B18BC69DDDFA00F90C0F4B30F48AB28573950635CE8DC95E99C402
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral6
- Target
  Craftrise hilesiymis/server.key
- Size 1KB
- SHA256 98c561b63065c0310b6168119d270b327ed87ab13754794a4748fba9b3ab598d
- MD5 7c473c7811d3dfad67fbd85a05735c2f
- SHA1 ffb98d11d2f22cb79cfde8e73391400f6527b9b4
- SHA512 b4be88c9d4c53f88efdec81125b15c9ad476b119715584a4239010f8ecebce80712b015a9acc5b5a5650b8e43a076d9700f9229a0aeda5c9ecc87a2da6721996
- TLSH
  T170312BDF19C816D8B89185FE1991CB21C21DCEF89131CD30020A18556DB8691D5FFC86
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7