darksiderat | 0e70800d412128837e04a7dd388a442aec9ca2c3b082c5fb2991c0188c892f10

General

Target
Aeox.exe
Size 166.3MB
Sample261111-2vbgmasvav
SHA256 0e70800d412128837e04a7dd388a442aec9ca2c3b082c5fb2991c0188c892f10
MD5 f7bbd26e77ceebc3f8c9b36c29dc296f
SHA1 aaf4ae819120c0edb210833e880d32260c421f7f
SHA512 8a63a30338976a67fa542d22e0f4b668e34ae32c74144b1fcee614f022b3fab76fbdcda56ecf4d12ac815fb83bccaedda668a58011895da130a52215dcef310e
SSDEEP 786432:pKYzF7JuyAqdK6h/IEEpr4lQ7R13kUq0O4gfygAqW6kGRfvmYEYpB5:4YdJu0t/0Pe4UEgeY5R
TLSH
T17C888D1163E81A45E67B8678977382A1EAB5BC535311C1CF1084F94E2F73BC2BA36376
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Aeox.exe
- Size 166.3MB
- SHA256 0e70800d412128837e04a7dd388a442aec9ca2c3b082c5fb2991c0188c892f10
- MD5 f7bbd26e77ceebc3f8c9b36c29dc296f
- SHA1 aaf4ae819120c0edb210833e880d32260c421f7f
- SHA512 8a63a30338976a67fa542d22e0f4b668e34ae32c74144b1fcee614f022b3fab76fbdcda56ecf4d12ac815fb83bccaedda668a58011895da130a52215dcef310e
- SSDEEP 786432:pKYzF7JuyAqdK6h/IEEpr4lQ7R13kUq0O4gfygAqW6kGRfvmYEYpB5:4YdJu0t/0Pe4UEgeY5R
- TLSH
  T17C888D1163E81A45E67B8678977382A1EAB5BC535311C1CF1084F94E2F73BC2BA36376
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery darksiderat persistence trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

1

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Power Settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2