darksiderat | be8ffa2deeb1ad590f371dfc031c4701010de583a091b9e9ad81e5d421ebbee0

General

Target
account gen.exe
Size 368KB
Sample260912-q1v8facf99
SHA256 be8ffa2deeb1ad590f371dfc031c4701010de583a091b9e9ad81e5d421ebbee0
MD5 93b152ddba79f433c3a17fa907c01a06
SHA1 8cce14920662a7c2ffc3595bb625ef5e7603735a
SHA512 e85dbb45c4b40bd67b0594ddc6cb96f717ce98dab7c4a2147e42225e89fef1076b56a1303653c80209c42c03535df817e05735a7706096da0ce65c362aab6126
SSDEEP 6144:QwR3cLrvZBKCGfiRm/6nEVAQFXOhEwYRfZuy6MTI1Ng1NdiSKRa58z8SsD:QW3mkSRSFAQ4q14Jr7sdi1Ram
TLSH
T12984231453DF95A3D87578339E6642B44B3FBA9E4D86AB2363CC1DB8AB16784FD90003
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Targets

- Target
  account gen.exe
- Size 368KB
- SHA256 be8ffa2deeb1ad590f371dfc031c4701010de583a091b9e9ad81e5d421ebbee0
- MD5 93b152ddba79f433c3a17fa907c01a06
- SHA1 8cce14920662a7c2ffc3595bb625ef5e7603735a
- SHA512 e85dbb45c4b40bd67b0594ddc6cb96f717ce98dab7c4a2147e42225e89fef1076b56a1303653c80209c42c03535df817e05735a7706096da0ce65c362aab6126
- SSDEEP 6144:QwR3cLrvZBKCGfiRm/6nEVAQFXOhEwYRfZuy6MTI1Ng1NdiSKRa58z8SsD:QW3mkSRSFAQ4q14Jr7sdi1Ram
- TLSH
  T12984231453DF95A3D87578339E6642B44B3FBA9E4D86AB2363CC1DB8AB16784FD90003
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Suspicious use of NtCreateUserProcessOtherParentProcess

Checks computer location settings

Executes dropped EXE

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2