darksiderat | cb6c5f89b766535d7216c9c062ac04cf68a4cd2cb41f87a19bb23d4137d5b0ea

General

Target
2026-08-21_b8035c12f0ea03a3dbc307063cd9e700_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 196KB
Sample260821-mbannastdy
SHA256 cb6c5f89b766535d7216c9c062ac04cf68a4cd2cb41f87a19bb23d4137d5b0ea
MD5 b8035c12f0ea03a3dbc307063cd9e700
SHA1 3b357296f0204401fde51177b8756c40820dfbdb
SHA512 ad51f212259c4a2e461f39e0c154c9ad4aeb150a1aecef7bc134b41add4fa56736833b0235cb708772c55fb50cac415c95288ff3f1dee9eb675c63c31dd13302
SSDEEP 3072:FQSdH9vtgquKB/se8nd/KOEka+wRhnEPU6Ow9wR0+CDnC9:OSV9vtB/se8ndp9Yho9e20
TLSH
T175147D15B6A500FAD2778534C9510A12FB737C4607B0AAEF47A04BF59F23AD0AE3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-21_b8035c12f0ea03a3dbc307063cd9e700_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 196KB
- SHA256 cb6c5f89b766535d7216c9c062ac04cf68a4cd2cb41f87a19bb23d4137d5b0ea
- MD5 b8035c12f0ea03a3dbc307063cd9e700
- SHA1 3b357296f0204401fde51177b8756c40820dfbdb
- SHA512 ad51f212259c4a2e461f39e0c154c9ad4aeb150a1aecef7bc134b41add4fa56736833b0235cb708772c55fb50cac415c95288ff3f1dee9eb675c63c31dd13302
- SSDEEP 3072:FQSdH9vtgquKB/se8nd/KOEka+wRhnEPU6Ow9wR0+CDnC9:OSV9vtB/se8ndp9Yho9e20
- TLSH
  T175147D15B6A500FAD2778534C9510A12FB737C4607B0AAEF47A04BF59F23AD0AE3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Deletes itself
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Suspicious use of NtCreateUserProcessOtherParentProcess

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Deletes itself

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2