darksiderat | 92545f79aeb5882695b7b13c211ebacf3f635dbc270e5f1c5ddd1e5fc131c380

General

Target
260808-qj2znadf56_pw_infected.zip
Size 2.6MB
Sample260808-qqhvcsxfnb
SHA256 92545f79aeb5882695b7b13c211ebacf3f635dbc270e5f1c5ddd1e5fc131c380
MD5 74645c7819668348933fc4f8d60a06b4
SHA1 1c0f449573073bd2a2c02d115831a2727682d215
SHA512 3dc1fb49d1e39d89db3966f0d6ba1cdae4f9e3874574b9d237e43fda68c445835165062ffdb79b030fe7e4a70b027ceb6bf4651333e8b1cdbaee5729385811f8
SSDEEP 49152:ycWCkVlJdu4pMkVVxKF7c/+56fcgCWh7YlCxEPs6i7Esfn9D1Jy+uAW:zWDV5LZVu4260LWh7JZnwy1ny/5
TLSH
T165C5333059B87084D6D4E9B349817997BBC2080D673416D7A6FBEE1BBA061D2F037A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Soda_lol.exe
- Size 8.4MB
- SHA256 304f1e07e2ae215c879ab68e8b7407142c2c0ef112c5f93f73fb4e5b9f8f9db6
- MD5 aec6232155a51b6d0d4d2316cb0de6ae
- SHA1 6fa674d13d99da07ebf2e556e4f03280d15bf9e4
- SHA512 d90a6dd8da39308a21abe0ab956ece4bab1a161e3e7e80d1d7ac5970a7e628df4316767883b2e723c15f65ce6f5017efa57237239ca303e865282ef26583e0bd
- SSDEEP 98304:jWwhZo+ylyfwQWcJ3lr+hkFSPQ8+8V80/j7xqpUP:awhZo+ylyfwQWcJ3lr+h4mlzwOP
- TLSH
  T15796E5257B5F996CD09BC474824B8A66492030DB0B39A9FF4484963C2F7EBF56F38319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Downloads MZ/PE file

Executes dropped EXE

Checks whether UAC is enabled

Network Share Discovery

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2