darksiderat | 0ac9a2e89a2c61ea2a613028ba954bc35acb0f99ea6af82c3187824e5b806978

General

Target
2026-08-08_b84167c684fbd00c5c48d0aad65c380d_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 13.2MB
Sample260808-dcdl9sgl7t
SHA256 0ac9a2e89a2c61ea2a613028ba954bc35acb0f99ea6af82c3187824e5b806978
MD5 b84167c684fbd00c5c48d0aad65c380d
SHA1 0c802d3548359e7813096cb542676903bff8d624
SHA512 ef8c0f52d925b6a58d4de58a3d714b3cbd53802ba2eceb45d02e135f8106292e2283c83ee3ce9dbb90e81427e8607cf96c503a4d21d2c7313276b16cd9677d63
SSDEEP 98304:YUWc6ndSKCm7GGOp09KXTqUrRKPHmps62trZZBbChgHohog/pzjyUnu:YUW/RCjG00UXTvrYE/2trZPChgISYz
TLSH
T170E68D62669D4A9DE067B138C9875207EBF17C081320CFEB55D08D6B5E3FAD0B93A319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_b84167c684fbd00c5c48d0aad65c380d_glassworm_icedid_luca-stealer_njrat_stealc_vidar
- Size 13.2MB
- SHA256 0ac9a2e89a2c61ea2a613028ba954bc35acb0f99ea6af82c3187824e5b806978
- MD5 b84167c684fbd00c5c48d0aad65c380d
- SHA1 0c802d3548359e7813096cb542676903bff8d624
- SHA512 ef8c0f52d925b6a58d4de58a3d714b3cbd53802ba2eceb45d02e135f8106292e2283c83ee3ce9dbb90e81427e8607cf96c503a4d21d2c7313276b16cd9677d63
- SSDEEP 98304:YUWc6ndSKCm7GGOp09KXTqUrRKPHmps62trZZBbChgHohog/pzjyUnu:YUW/RCjG00UXTvrYE/2trZPChgISYz
- TLSH
  T170E68D62669D4A9DE067B138C9875207EBF17C081320CFEB55D08D6B5E3FAD0B93A319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2