nigger_build.zip
- SHA256 b7d8fe51bf001cf09009f8b9449af06aeb9ff327c6e846275d984725d6cabde0
Behavioral task
behavioral1
Sample
nigger.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target nigger_build.zip
- Size 33KB
- Sample260803-vk6rfstemg
- SHA256 b7d8fe51bf001cf09009f8b9449af06aeb9ff327c6e846275d984725d6cabde0
- MD5 4c0c380aea619dedfd7efce85ed37943
- SHA1 057e40cf5dddfca98ba58b241bb4847ac850bc0e
- SHA512 7023239ada723c2c2bae71f10a600bb377a017bdb2a809f4f7fa90239c4d94dd369744e247bee8d3af483bbe186df7f6ea9f4872887df013c9bb35fc138d1812
- SSDEEP 768:JPGA+e85kjPftSrDVAvU8IFxh0ucuziyKViJs6SXybYWD+d:1GA+e85YfY388xh0ScQ66VRs
- TLSH T166F2F2E7D052412681BB787B5788ECE7514D9B88ACA7872D3D2FDF40431C25AA2DF9B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 1 IoCs
resource yara_rule static1/unpack001/nigger.exe family_darksiderat - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/nigger.exe
File Explorer
-
nigger_build.zip.zip .js 33KB
-
nigger.exe.exe 87KB
nigger.exe
- IMPHASH d2197c92ed2666bd180912a2080f3632
- SHA256 002c9a0bdbcc7a94b3611114357f32b085a70f75890c2f2a42726ffcd6040f6b
- MD5 3167216a5bb93d78ed435666970e6303
- SHA1 302d24f71a02387e2e6a157638aebe88cf28cf8a
- SHA512 1d8597b6dfc56ca720e6b43b7756255dc22d612b6fad7551a4a74a9543d7e912e739117983f3a116094e8f2831f1d1e7765eeef0cd7f8b723907ef68e01361a1
- SSDEEP 1536:8SbHxrv7R3cZYjdddU7ehomTkSGJrjolYu1l/:8SbRrv7R3cCFPUuP
- TLSH T14293E436DD9EB52ED2059478EE464C05DA23B89E8661BFB72BC24CD60FD6E601F2C5C0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects DarkSideRAT
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
57460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
WSAStartup
crypt32
CryptStringToBinaryA
kernel32
TerminateProcess
ReleaseSRWLockExclusive
GlobalMemoryStatusEx
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
AcquireSRWLockExclusive
GetStartupInfoW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Xout_of_range@std@@YAXPEBD@Z
dxgi
CreateDXGIFactory
wininet
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
memmove
__current_exception_context
__current_exception
memset
memcpy
memcmp
__std_exception_copy
__std_exception_destroy
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
_callnewh
free
_set_new_mode
malloc
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-runtime-l1-1-0
_exit
exit
_register_thread_local_exe_atexit_callback
_initterm
_cexit
_register_onexit_function
_initterm_e
terminate
_get_narrow_winmain_command_line
_c_exit
_initialize_onexit_table
_set_app_type
_initialize_narrow_environment
_invoke_watson
_configure_narrow_argv
_seh_filter_exe
_crt_atexit
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
58KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
116B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35207,
count=10, id=260, version=35207,
count=29, id=261, version=35207,
count=6, id=257, version=35207,
count=114, id=1, productName=Unmarked objects,
count=11, id=257, version=33145,
count=1, id=265, version=35223,
count=1, id=255, version=35223,
count=1, id=258, version=35223,