darksiderat | 363f96923113cd0743266e99da908bf227ef5106a32870d05880172861228f33

General

Target
ExternSpotiBai.exe
Size 7.2MB
Sample260905-akfvtashqf
SHA256 363f96923113cd0743266e99da908bf227ef5106a32870d05880172861228f33
MD5 8b30024fa4724d84b72a2309714ea97a
SHA1 2be212cb7c620b24fc6472d2ccae53370a8a6208
SHA512 555946bf5617ddfb494f7287a4cea84bdda15274cddc3ba01d24dc80780f6c37674af1c1349b59279100d4a69b8c74b37b389041cad45e64557e353c5811da42
SSDEEP 98304:X02uTIw8R8MLxjmjqkxBy3ElkU2RkECnsVbeVetYkbuTxloEJSMuDXaYzhsrOZC+:kvIRZxjm+s0EIRQU8e2kgo4mXak+OZC
TLSH
T16276334A5F806C17C537BBF440B0E7B7A3444F8866A6C7839CFAED63BA9D0999D841D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  ExternSpotiBai.exe
- Size 7.2MB
- SHA256 363f96923113cd0743266e99da908bf227ef5106a32870d05880172861228f33
- MD5 8b30024fa4724d84b72a2309714ea97a
- SHA1 2be212cb7c620b24fc6472d2ccae53370a8a6208
- SHA512 555946bf5617ddfb494f7287a4cea84bdda15274cddc3ba01d24dc80780f6c37674af1c1349b59279100d4a69b8c74b37b389041cad45e64557e353c5811da42
- SSDEEP 98304:X02uTIw8R8MLxjmjqkxBy3ElkU2RkECnsVbeVetYkbuTxloEJSMuDXaYzhsrOZC+:kvIRZxjm+s0EIRQU8e2kgo4mXak+OZC
- TLSH
  T16276334A5F806C17C537BBF440B0E7B7A3444F8866A6C7839CFAED63BA9D0999D841D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion darksiderat themida trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2