darksiderat | 16705efd2cf4d2b7604f012bd66b15002686863bdf9ea6d3efe2df8242c066cd

General

Target
2026-08-17_9134c1c6a7964f80991f3fa58c4b5384_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.4MB
Sample260818-afnpvsbl9z
SHA256 16705efd2cf4d2b7604f012bd66b15002686863bdf9ea6d3efe2df8242c066cd
MD5 9134c1c6a7964f80991f3fa58c4b5384
SHA1 33b83662b80eda358b0623a39aa113c487c7624e
SHA512 d52a36b4fc90caf25f14113d50903da0d664676d894f34f9778bee5a3c7345761f3094d4e2a63a64ec9f2648566f7f4d58ffb5125392c316a5a957a37622f67d
SSDEEP 24576:6XreZhjE063fB6/EidKcbN3OHNoRZYifzJI/xCvuijxXDR9QYVISkaGyo+XTxZZS:fuscidPbN3OH+Q4Hd/Q5hTnKNEAPa
TLSH
T1DEB59DC6A3E5C6ABE37685B0885291339AB6B9134330D5EB53D00D565E376F00EB6B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_9134c1c6a7964f80991f3fa58c4b5384_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.4MB
- SHA256 16705efd2cf4d2b7604f012bd66b15002686863bdf9ea6d3efe2df8242c066cd
- MD5 9134c1c6a7964f80991f3fa58c4b5384
- SHA1 33b83662b80eda358b0623a39aa113c487c7624e
- SHA512 d52a36b4fc90caf25f14113d50903da0d664676d894f34f9778bee5a3c7345761f3094d4e2a63a64ec9f2648566f7f4d58ffb5125392c316a5a957a37622f67d
- SSDEEP 24576:6XreZhjE063fB6/EidKcbN3OHNoRZYifzJI/xCvuijxXDR9QYVISkaGyo+XTxZZS:fuscidPbN3OH+Q4Hd/Q5hTnKNEAPa
- TLSH
  T1DEB59DC6A3E5C6ABE37685B0885291339AB6B9134330D5EB53D00D565E376F00EB6B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution darksiderat trojan discovery
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies file permissions
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Executes dropped EXE

Modifies file permissions

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2