Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://cdn.discordapp.com/attachments/1538981433236922409/1538987746935177256/NexusTweaks.rar?ex=6a8bedc7&is=6a8a9c47&hm=ec8acfd537019a0ab004a66f654e9d792de9179a347a2dd00a5993b9a55e5318&amp
  • Sample260823-mglccafr4y
Score
10/10
darksideratdiscoverypersistenceransomwaretrojan

Malware Config

Targets

    • Target
      https://cdn.discordapp.com/attachments/1538981433236922409/1538987746935177256/NexusTweaks.rar?ex=6a8bedc7&is=6a8a9c47&hm=ec8acfd537019a0ab004a66f654e9d792de9179a347a2dd00a5993b9a55e5318&amp
    Score
    10/10
    discoverydarksideratpersistenceransomwaretrojan

    • Detects DarkSideRAT

    • Family: DarkSideRAT

      DarkSideRAT is a remote access trojan.

      trojandarksiderat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks