darksiderat | 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635

General

Target
2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
Size 5.0MB
Sample261104-e7bltse18z
SHA256 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635
MD5 e6eef8e6821ff6b2cdb4e2f717f13729
SHA1 a8df1217f07b27a7a680893672882eb9456df4bc
SHA512 daf12cd7822eca38183f70f9445cb656d4cae9442be4f9ca4193b7b393a50f53d2eb569ceb11e6dfce30dde706f37ed247a049f5c124b6351b586d40f8a9b9a3
SSDEEP 49152:ROjPWCYlcqTdNuNoY1fcvTFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamLQ:HTqf4YaQzVpEBTQtB71THSvF2k
TLSH
T16A369D56A3E500E8D1B7C178CE964127E7B2BC061371DBDF02A0666A1F37AE16E3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-03_e6eef8e6821ff6b2cdb4e2f717f13729_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar
- Size 5.0MB
- SHA256 61c35ecbd844ae6509484a0b71bec1abf9122a76a09c7e3c32e9632aedabe635
- MD5 e6eef8e6821ff6b2cdb4e2f717f13729
- SHA1 a8df1217f07b27a7a680893672882eb9456df4bc
- SHA512 daf12cd7822eca38183f70f9445cb656d4cae9442be4f9ca4193b7b393a50f53d2eb569ceb11e6dfce30dde706f37ed247a049f5c124b6351b586d40f8a9b9a3
- SSDEEP 49152:ROjPWCYlcqTdNuNoY1fcvTFYaQzVUu8cdV0hN81Tvs0ET2lKBay1Jtyun95QamLQ:HTqf4YaQzVpEBTQtB71THSvF2k
- TLSH
  T16A369D56A3E500E8D1B7C178CE964127E7B2BC061371DBDF02A0666A1F37AE16E3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

Query Registry

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops desktop.ini file(s)

Network Service Discovery

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2