darksiderat | 52f56c296e2e7fcb433a032b2243b84ffb61cf85c70870603db4e8138d01e702

General

Target
2026-08-20_408e6dcc009567b9611baa1118529586_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 807KB
Sample260820-gqechafk6y
SHA256 52f56c296e2e7fcb433a032b2243b84ffb61cf85c70870603db4e8138d01e702
MD5 408e6dcc009567b9611baa1118529586
SHA1 3adc01def43ac025f0a8eaee73d7acbe14dd627f
SHA512 f31fa3b02e71144f5ed17f686ef2f057976a237225a79f2b28a8e1f01fcff2202ef41eea7aadf3fd799ce231401871f09097904f61f6176e9ff49b7f846ca71a
SSDEEP 12288:ksjW5NYVB0Ny0/wzqOxoU+Z013QwpCUbwmb45z3rUsZrbWbpwabZQxbDRWbjbyUM:bW5NmBT042Oxo1aJQwwBl
TLSH
T1C2058D26AB8512BCE0B7C17ACE824952F771740B03A15ADF37EC41A61F7B5D09E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_408e6dcc009567b9611baa1118529586_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 807KB
- SHA256 52f56c296e2e7fcb433a032b2243b84ffb61cf85c70870603db4e8138d01e702
- MD5 408e6dcc009567b9611baa1118529586
- SHA1 3adc01def43ac025f0a8eaee73d7acbe14dd627f
- SHA512 f31fa3b02e71144f5ed17f686ef2f057976a237225a79f2b28a8e1f01fcff2202ef41eea7aadf3fd799ce231401871f09097904f61f6176e9ff49b7f846ca71a
- SSDEEP 12288:ksjW5NYVB0Ny0/wzqOxoU+Z013QwpCUbwmb45z3rUsZrbWbpwabZQxbDRWbjbyUM:bW5NmBT042Oxo1aJQwwBl
- TLSH
  T1C2058D26AB8512BCE0B7C17ACE824952F771740B03A15ADF37EC41A61F7B5D09E3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Detects executables referencing many IR and analysis tools
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Detects executables referencing many IR and analysis tools

Checks whether UAC is enabled

Network Share Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2