darksiderat | ff359da67a162835a5cdbe0c21a86f328e2ed461db5690a1bb22ee99fe601a82

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 03:44

Target
2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe
Size 288KB
Sample260908-eaxssszvdy
SHA256 ff359da67a162835a5cdbe0c21a86f328e2ed461db5690a1bb22ee99fe601a82
MD5 df9c8c60245ee8c25b4ef6a4978a67f5
SHA1 11b47c979376a9412d4340f968b33be618d6f7be
SHA512 e08abca966aa9f702951071dab92daa6cfa915ee533cfa92226a73b74485f5af34f7b21e58d65fe2d31f657d269da0097b29bc893893731aafcbf85da168b401
SSDEEP 3072:Zbee7KB+VE/Il/F2ReIKt2lC8nU09TMFamTSEupOkcfTvN2ieejARv2UY6+WSvm:ZiEOC/ARewlC8nU0aVTYWfT12cO
TLSH
T116546C11BF465DAED56AC07882418A73A93274CA0B32EAFF41D446393F6ADF56F3C214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/5096-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5096-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 996 set thread context of 5096	996	2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 5096	996	2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe	90
PID 996 wrote to memory of 5096	996	2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe	90
PID 996 wrote to memory of 5096	996	2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe	90
PID 996 wrote to memory of 5096	996	2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe	90
PID 996 wrote to memory of 5096	996	2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe	90
PID 996 wrote to memory of 5096	996	2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe	90
PID 996 wrote to memory of 5096	996	2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:996
- C:\Users\Admin\AppData\Local\Temp\2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-07_df9c8c60245ee8c25b4ef6a4978a67f5_akira_rusty-stealer.exe"
  2⤵
  PID:5096

memory/996-0-0x0000000140000000-0x0000000140059000-memory.dmp

Download

memory/996-3-0x0000000140000000-0x0000000140059000-memory.dmp

Download

memory/5096-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5096-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download