darksiderat | a20dfec44c2d470deaa046042b7360750f46afcd602ab5634c4cb05ef85bb70b

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 08:09

Target
2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe
Size 165KB
Sample260908-j2kprseb32
SHA256 a20dfec44c2d470deaa046042b7360750f46afcd602ab5634c4cb05ef85bb70b
MD5 b124f317d6f2ac2aa75e3424a38b509f
SHA1 4ecb283736118d36805c685e5a7465692ac2795c
SHA512 4185e636033a5916cdfaa692adf87c048953122760988983b5636b23bc6365e2a783b896fe8a4dd4f811cf71defd02c8c387d93a1f97ac928cba00c4d86aa23f
SSDEEP 3072:O4/Fbx4v04ofJgyIXCFDIP1yXp/3UY6+WSvm:O4/hx4v04ofy4FDAw/Q
TLSH
T123F37D12BB4161EDD45EC074826549B7B362B0C90F319BFF17A502382FAA9F66F3C664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/4668-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4668-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3912 set thread context of 4668	3912	2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4668	3912	2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe	89
PID 3912 wrote to memory of 4668	3912	2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe	89
PID 3912 wrote to memory of 4668	3912	2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe	89
PID 3912 wrote to memory of 4668	3912	2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe	89
PID 3912 wrote to memory of 4668	3912	2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe	89
PID 3912 wrote to memory of 4668	3912	2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe	89
PID 3912 wrote to memory of 4668	3912	2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Local\Temp\2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-07_b124f317d6f2ac2aa75e3424a38b509f_akira_rusty-stealer.exe"
  2⤵
  PID:4668

memory/3912-0-0x0000000140000000-0x000000014003A000-memory.dmp

Download

memory/3912-3-0x0000000140000000-0x000000014003A000-memory.dmp

Download

memory/4668-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4668-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download