darksiderat | fa753f435b084c1e39f546dc1321ea28ed67ab7eeecdfdeff9b6a99d8b708450

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/09/2026, 10:44

Target
2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe
Size 82KB
Sample260914-mtaflsycmf
SHA256 fa753f435b084c1e39f546dc1321ea28ed67ab7eeecdfdeff9b6a99d8b708450
MD5 7c05435b72df3a122fd27844c04d394f
SHA1 fb740dc5fdaeb44ca67f159d3ea9bc6a9f98916a
SHA512 2b4d28b3410775f1e80b40a200f1127e4f4b9a7ae43872a4e3614aa344fb6bb0522c5b2d408506bef4b964cd798eb31df7a34718127fc13ca902500ec3f77af8
SSDEEP 1536:F1Q04S3Bgksvim9us0B7AG8Du6+WSss/eYwp:F1Qu3iQmb0BUY6+WSvm
TLSH
T19D83AE07DFC601F9D05DC1B483A66273A976F84A0351A1FF5B84A7026EB4BD4AB7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 4 IoCs

resource	yara_rule
behavioral1/memory/4532-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4532-4-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4532-3-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral1/memory/4532-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4632 set thread context of 4532	4632	2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe	89

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4532	4632	2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe	89
PID 4632 wrote to memory of 4532	4632	2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe	89
PID 4632 wrote to memory of 4532	4632	2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe	89
PID 4632 wrote to memory of 4532	4632	2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe	89
PID 4632 wrote to memory of 4532	4632	2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe	89
PID 4632 wrote to memory of 4532	4632	2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe	89
PID 4632 wrote to memory of 4532	4632	2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-14_7c05435b72df3a122fd27844c04d394f_akira_rusty-stealer.exe"
  2⤵
  PID:4532

memory/4532-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4532-4-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4532-3-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4532-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4632-0-0x0000000140000000-0x0000000140027000-memory.dmp

Download

memory/4632-5-0x0000000140000000-0x0000000140027000-memory.dmp

Download