darksiderat | 389746bc1ea51008e390a2b84fa07cdea2ef9360782451d233f6df902e7b041b

General

Target
2026-11-09_0895ff710dc0c2b270aefcb442169103_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
Size 11.5MB
Sample261111-empyqatv9n
SHA256 389746bc1ea51008e390a2b84fa07cdea2ef9360782451d233f6df902e7b041b
MD5 0895ff710dc0c2b270aefcb442169103
SHA1 48ddea44df6f6914998aa8f0a2e4b9cc0b3886ff
SHA512 683778cc38757ebf25100688a56f8a98bf7ddb429d3f2a4f7cbcb5d2693e396b5ee86b7753567f831bec7b2f556f0ee92b25f76ec2881768938065dd5a8f3f0c
SSDEEP 196608:RPY0yk+DfyGR21X5Sp6GemDMPwSaw2cgWgvJHDO6n0W8/LaGYPnkRb3:pY0yxDfDspfaMPXaw2lIW8vTb
TLSH
T10BC6337EE73219EEECFAA17BD58341676AA4701603ACAD4716170D91CF8B2C13D3B621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-09_0895ff710dc0c2b270aefcb442169103_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar
- Size 11.5MB
- SHA256 389746bc1ea51008e390a2b84fa07cdea2ef9360782451d233f6df902e7b041b
- MD5 0895ff710dc0c2b270aefcb442169103
- SHA1 48ddea44df6f6914998aa8f0a2e4b9cc0b3886ff
- SHA512 683778cc38757ebf25100688a56f8a98bf7ddb429d3f2a4f7cbcb5d2693e396b5ee86b7753567f831bec7b2f556f0ee92b25f76ec2881768938065dd5a8f3f0c
- SSDEEP 196608:RPY0yk+DfyGR21X5Sp6GemDMPwSaw2cgWgvJHDO6n0W8/LaGYPnkRb3:pY0yxDfDspfaMPXaw2lIW8vTb
- TLSH
  T10BC6337EE73219EEECFAA17BD58341676AA4701603ACAD4716170D91CF8B2C13D3B621
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery darksiderat trojan
- Detects DarkSideRAT
- Family: DarkSideRAT
  DarkSideRAT is a remote access trojan.
  trojan darksiderat
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  edge.pyc
- Size 16B
- SHA256 bf8b7ac42546a146f1ebf72707d283fef6ec43b82522f07d39ca1251a9cf0ef0
- MD5 3a0d4309583f2f5b242e352130abcc01
- SHA1 f69758b7687c4337f7235fdd9e8723c49d254287
- SHA512 e966a8aa2752a3054cbc5fdb0a05e4edcd5e379f3536d074151e5f9034408cf7b70260f2d1bcf7d4e8bcf633264850d76696164d49b4d2de64d06ed699745d55
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects DarkSideRAT

Family: DarkSideRAT

Downloads MZ/PE file

Executes dropped EXE

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4