darksiderat | a66fd4d15b16e32818a974e82ea2167af12133ef0d8e92039d57e835f0989457

General

Target
2026-08-07_4d403e4623d938b25a469c3d844844e5_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 13.2MB
Sample260807-egkrtaxarh
SHA256 a66fd4d15b16e32818a974e82ea2167af12133ef0d8e92039d57e835f0989457
MD5 4d403e4623d938b25a469c3d844844e5
SHA1 f37d3bbd87c78ccfe3a144f1fb8b8844c7555ef9
SHA512 de1165b0e0c3adca7dc7b2d1b402103e4cd50b355b1e5dbe1de4de1d5d6a519a01fe172f0ccd32f88fb948de75f4f55ed5351f70144f3919987827fd49ba453a
SSDEEP 98304:TUWc6ndSKCm7GOOp09KXTqUtQVxpDpJryMdZBbChgHohog/pzjyUnY:TUW/RCjO00UXTvtKtVTdPChgISYz
TLSH
T170D68C61669D4A9DE06BB138C9875207EBF17C081320CFEB55D08D6B5E3FAD0B93A319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-07_4d403e4623d938b25a469c3d844844e5_glassworm_icedid_luca-stealer_njrat_stealc_vidar
- Size 13.2MB
- SHA256 a66fd4d15b16e32818a974e82ea2167af12133ef0d8e92039d57e835f0989457
- MD5 4d403e4623d938b25a469c3d844844e5
- SHA1 f37d3bbd87c78ccfe3a144f1fb8b8844c7555ef9
- SHA512 de1165b0e0c3adca7dc7b2d1b402103e4cd50b355b1e5dbe1de4de1d5d6a519a01fe172f0ccd32f88fb948de75f4f55ed5351f70144f3919987827fd49ba453a
- SSDEEP 98304:TUWc6ndSKCm7GOOp09KXTqUtQVxpDpJryMdZBbChgHohog/pzjyUnY:TUW/RCjO00UXTvtKtVTdPChgISYz
- TLSH
  T170D68C61669D4A9DE06BB138C9875207EBF17C081320CFEB55D08D6B5E3FAD0B93A319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2