darksiderat | 71f0882b3b8452867cf7123f36089091598b02c37bef853a5384e2098cec60bd

Sharing

Copy URL Twitter E-mail

General

Target
Eclipse AI.exe
Size 3.5MB
Sample261002-errywagg86
SHA256 71f0882b3b8452867cf7123f36089091598b02c37bef853a5384e2098cec60bd
MD5 c7414423c9a780c7761c4e9d11afc5f0
SHA1 76f1935ddd58e3dbb41f5cded92b20d7d4673b86
SHA512 eb280f8a05cefbc24b01ec536c9a29e9db294a30a47d4476516ea72587183bfa5c88257cd6599758f5c60fc734d964d7249c8e68b2028c13b71932c7d1f7e6df
SSDEEP 98304:nlc6S41ddkp42m8GIwu4nNbkez1Nf2ATV0et7Qyt6YuLjzvUmF4W:LScb2/PEpkC1NeATqUvCtR
TLSH
T170062355ABE010FBE9FB053DC852A486DA72389A0712DADF937486550F337E0AE3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Eclipse AI.exe
- Size 3.5MB
- SHA256 71f0882b3b8452867cf7123f36089091598b02c37bef853a5384e2098cec60bd
- MD5 c7414423c9a780c7761c4e9d11afc5f0
- SHA1 76f1935ddd58e3dbb41f5cded92b20d7d4673b86
- SHA512 eb280f8a05cefbc24b01ec536c9a29e9db294a30a47d4476516ea72587183bfa5c88257cd6599758f5c60fc734d964d7249c8e68b2028c13b71932c7d1f7e6df
- SSDEEP 98304:nlc6S41ddkp42m8GIwu4nNbkez1Nf2ATV0et7Qyt6YuLjzvUmF4W:LScb2/PEpkC1NeATqUvCtR
- TLSH
  T170062355ABE010FBE9FB053DC852A486DA72389A0712DADF937486550F337E0AE3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  screen_detector_qt_app.pyc
- Size 16B
- SHA256 707195db9737c31733674b9786c611675f3e86afc3f8236be35cb8ffc6eceb38
- MD5 b9b66f803efb8c145a0b78bf768ffcde
- SHA1 071f91f6bd8b0b476134e2043b48b78230003215
- SHA512 9d02dfd0d5ca5477a755f3b8fdc10475b8737ecd667428cad5dd600fbe27c2c0ba1fd98b98d69663dadecd05b3138295a8dba608990c8846a9963289a47db639
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5 behavioral6 behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Downloads MZ/PE file

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8