darksiderat | 304f1e07e2ae215c879ab68e8b7407142c2c0ef112c5f93f73fb4e5b9f8f9db6

General

Target
Soda_lol.exe
Size 8.4MB
Sample260808-qj2znadf56
SHA256 304f1e07e2ae215c879ab68e8b7407142c2c0ef112c5f93f73fb4e5b9f8f9db6
MD5 aec6232155a51b6d0d4d2316cb0de6ae
SHA1 6fa674d13d99da07ebf2e556e4f03280d15bf9e4
SHA512 d90a6dd8da39308a21abe0ab956ece4bab1a161e3e7e80d1d7ac5970a7e628df4316767883b2e723c15f65ce6f5017efa57237239ca303e865282ef26583e0bd
SSDEEP 98304:jWwhZo+ylyfwQWcJ3lr+hkFSPQ8+8V80/j7xqpUP:awhZo+ylyfwQWcJ3lr+h4mlzwOP
TLSH
T15796E5257B5F996CD09BC474824B8A66492030DB0B39A9FF4484963C2F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Soda_lol.exe
- Size 8.4MB
- SHA256 304f1e07e2ae215c879ab68e8b7407142c2c0ef112c5f93f73fb4e5b9f8f9db6
- MD5 aec6232155a51b6d0d4d2316cb0de6ae
- SHA1 6fa674d13d99da07ebf2e556e4f03280d15bf9e4
- SHA512 d90a6dd8da39308a21abe0ab956ece4bab1a161e3e7e80d1d7ac5970a7e628df4316767883b2e723c15f65ce6f5017efa57237239ca303e865282ef26583e0bd
- SSDEEP 98304:jWwhZo+ylyfwQWcJ3lr+hkFSPQ8+8V80/j7xqpUP:awhZo+ylyfwQWcJ3lr+h4mlzwOP
- TLSH
  T15796E5257B5F996CD09BC474824B8A66492030DB0B39A9FF4484963C2F7EBF56F38319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Downloads MZ/PE file

Executes dropped EXE

Checks whether UAC is enabled

Network Share Discovery

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2