darksiderat | ac6db08f5192be4b3eacf46cfc1ec26eeb1c087ae23c589f9849d21a5f8baf7d

General

Target
2026-08-19_c1bf74f8969e73383bd4dfc7c3a6596e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
Size 24.0MB
Sample260819-e37hpsdn3s
SHA256 ac6db08f5192be4b3eacf46cfc1ec26eeb1c087ae23c589f9849d21a5f8baf7d
MD5 c1bf74f8969e73383bd4dfc7c3a6596e
SHA1 4d9c7a433efde4dc2b4395e61d00d96ddf4c2d4e
SHA512 8843b77d0dce2bb00f40fd906c3c2363566bfc33db52d46097b6c78f68734b877f30575ae457dae1bb98b31ff1a0837f54562607067bef5c40f1c41cf49bc01b
SSDEEP 393216:8Vn7fwRX6DGwqtwNFv8h10S/o5X8+EUgfb2Gl5s8OvLG1wk3qOcYPfYYis4nWVEE:8lwRX6DGwqtICpo5sZzDpjsrG1w+gYPP
TLSH
T116473305DFAB45E6D1BF947C98825613D7A538490360EACF2B5489EB4F36BE40B3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-19_c1bf74f8969e73383bd4dfc7c3a6596e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc
- Size 24.0MB
- SHA256 ac6db08f5192be4b3eacf46cfc1ec26eeb1c087ae23c589f9849d21a5f8baf7d
- MD5 c1bf74f8969e73383bd4dfc7c3a6596e
- SHA1 4d9c7a433efde4dc2b4395e61d00d96ddf4c2d4e
- SHA512 8843b77d0dce2bb00f40fd906c3c2363566bfc33db52d46097b6c78f68734b877f30575ae457dae1bb98b31ff1a0837f54562607067bef5c40f1c41cf49bc01b
- SSDEEP 393216:8Vn7fwRX6DGwqtwNFv8h10S/o5X8+EUgfb2Gl5s8OvLG1wk3qOcYPfYYis4nWVEE:8lwRX6DGwqtICpo5sZzDpjsrG1w+gYPP
- TLSH
  T116473305DFAB45E6D1BF947C98825613D7A538490360EACF2B5489EB4F36BE40B3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion darksiderat pyinstaller spyware trojan discovery
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Subvert Trust Controls

2

T1553

Install Root Certificate

2

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Downloads MZ/PE file

Drops file in Drivers directory

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2