General
- Target mw3.exe
- Size 3.8MB
- Sample260805-h5dvysfe88
- SHA256 f05e79442b2ee0fcda6ac319ecd0d1c45a56bbe418a0fcdc40209daee95dea67
Score
10/10
Malware Config
Targets
-
- Target mw3.exe
- Size 3.8MB
- SHA256 f05e79442b2ee0fcda6ac319ecd0d1c45a56bbe418a0fcdc40209daee95dea67
Score10/10-
Detects DarkSideRAT
-
Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
-
Downloads MZ/PE file
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1