General
- Target 2026-08-06_f4dd3cd365242ba33b45cd6cd4ce12e3_coinminer_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar
- Size 37.5MB
- Sample260807-ab3cfscq4v
- SHA256 f176865d276d992cfdbd6407b9f68714bd310f4ecb53ce526445dccc4edd76f4
Score
10/10
Malware Config
Targets
-
- Target 2026-08-06_f4dd3cd365242ba33b45cd6cd4ce12e3_coinminer_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar
- Size 37.5MB
- SHA256 f176865d276d992cfdbd6407b9f68714bd310f4ecb53ce526445dccc4edd76f4
Score10/10-
Detects DarkSideRAT
-
Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
-
Detects executables containing commands for clearing Windows Event Logs
-
Detects executables referencing combination of virtualization drivers
-
Detects executables referencing many IR and analysis tools
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery
Attempt to gather information on host network.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1