darksiderat | 488b1e227e58e0105da23b458fb0595c8d9a6c474c2bd39e190981ee6ba2e841

General

Target
2026-08-27_edc43439e79f4a4c524c63e0860e7f2a_glassworm_icedid_luca-stealer_njrat_stealc
Size 5.7MB
Sample260828-c5gnyssfmd
SHA256 488b1e227e58e0105da23b458fb0595c8d9a6c474c2bd39e190981ee6ba2e841
MD5 edc43439e79f4a4c524c63e0860e7f2a
SHA1 f342e2a045cb469556ed8a7333c330bc2fb65da2
SHA512 5bd5e97cc076e50c9b3749959ccd797a70b4e85de157576122e2f807543306a999e73695066bc23d2fe39937d0af67935ce698714f769faeea617e0f51d4700d
SSDEEP 49152:ezf/n472FhYh7rE5M0BvYBxjQEI2v9oXlNoXqV1+R0x9yNWeUtjESFZZWP+ui+lG:KEGWql3+5KRZZWW86olqdEX2Lvy
TLSH
T13B56BE0F71D90EA8E276C37D8AA29623E6323C050F3059CB16E175995FABAC05F7B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-27_edc43439e79f4a4c524c63e0860e7f2a_glassworm_icedid_luca-stealer_njrat_stealc
- Size 5.7MB
- SHA256 488b1e227e58e0105da23b458fb0595c8d9a6c474c2bd39e190981ee6ba2e841
- MD5 edc43439e79f4a4c524c63e0860e7f2a
- SHA1 f342e2a045cb469556ed8a7333c330bc2fb65da2
- SHA512 5bd5e97cc076e50c9b3749959ccd797a70b4e85de157576122e2f807543306a999e73695066bc23d2fe39937d0af67935ce698714f769faeea617e0f51d4700d
- SSDEEP 49152:ezf/n472FhYh7rE5M0BvYBxjQEI2v9oXlNoXqV1+R0x9yNWeUtjESFZZWP+ui+lG:KEGWql3+5KRZZWW86olqdEX2Lvy
- TLSH
  T13B56BE0F71D90EA8E276C37D8AA29623E6323C050F3059CB16E175995FABAC05F7B711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables referencing many IR and analysis tools
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Detects executables containing URLs to raw contents of a Github gist

Detects executables referencing many IR and analysis tools

Checks whether UAC is enabled

Network Share Discovery

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2