General
- Target 2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc
- Size 464KB
- Sample260826-gs34msgq3v
- SHA256 c97367ab7ec677361ec252d8a48b7ac7768e9855a0b9c0dba1333b596de40df7
Score
10/10
Malware Config
Targets
-
- Target 2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc
- Size 464KB
- SHA256 c97367ab7ec677361ec252d8a48b7ac7768e9855a0b9c0dba1333b596de40df7
Score10/10-
Detects DarkSideRAT
-
Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.