MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8e869aabde78e5fc214c93fb73ccf6b4853613906595b032a971162e28e6474. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkSideRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8e869aabde78e5fc214c93fb73ccf6b4853613906595b032a971162e28e6474
SHA3-384 hash: dca218846276d52488a0c147162ed5d303304b639d3f260bfc6329af660412bc8ad0f6cd8e84be5c2b56f336af01eb4f
SHA1 hash: e6e4b0299fce3f2645dfa0cd0c18e4863b6e140b
MD5 hash: 76a1f15fb7397118d7dd24d197556ba4
humanhash: leopard-avocado-fillet-potato
File name:sostener.vbs
Download: download sample
Signature DarkSideRAT
Create hunting rule
File size:3'715'611 bytes
First seen:2026-08-11 18:13:46 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 49152:nCuvmfYK+bi18aqZ15pR5gFE8AOCqzPfqHlA:K
TLSH T19906BE80C1FBA1555EA3EA010B7F60C0563E989CCEEC440C1E6D4EA797DEE91FA4774A
Magika vba
Reporter abuse_ch
Tags:DarkSideRAT vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
44
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/80386/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
encrypted evasive obfuscated obfuscated powershell
Link:
https://www.filescan.io/uploads/6a7b6683176d6372a711ae3d/reports/ed7c99b6-14f8-4bf7-98b1-c9ea159989d1/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d8e869aabde78e5fc214c93fb73ccf6b4853613906595b032a971162e28e6474
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1956307
Signature
AI detected malicious Powershell script
Allocates memory in foreign processes
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Found API chain indicative of sandbox detection
Found direct / indirect Syscall (likely to bypass EDR)
Found stalling execution ending in API Sleep call
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Unusual module load detection (module proxying)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell decode and execute
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1956307 Sample: sostener.vbs Startdate: 11/08/2026 Architecture: WINDOWS Score: 100 34 rema200426.duckdns.org 2->34 36 www.google.com 2->36 38 3 other IPs or domains 2->38 56 Malicious sample detected (through community Yara rule) 2->56 58 Antivirus detection for URL or domain 2->58 60 Yara detected Powershell decode and execute 2->60 64 5 other signatures 2->64 10 wscript.exe 3 2->10         started        signatures3 62 Uses dynamic DNS services 34->62 process4 signatures5 74 Wscript starts Powershell (via cmd or directly) 10->74 76 Bypasses PowerShell execution policy 10->76 78 Windows Scripting host queries suspicious COM object (likely to drop second stage) 10->78 80 2 other signatures 10->80 13 powershell.exe 19 10->13         started        process6 signatures7 84 Writes to foreign memory regions 13->84 86 Modifies the context of a thread in another process (thread injection) 13->86 88 Injects a PE file into a foreign processes 13->88 16 RegSvcs.exe 20 13->16         started        20 conhost.exe 13->20         started        process8 dnsIp9 30 rema200426.duckdns.org 186.169.76.60, 3585, 49725 COLOMBIATELECOMUNICACIONESSAESPBICCO Colombia 16->30 32 pee-files.nl 5.175.206.21, 443, 49727 ALTUNHOSTGB Germany 16->32 48 Found stalling execution ending in API Sleep call 16->48 50 Found API chain indicative of sandbox detection 16->50 52 Contains functionality to inject threads in other processes 16->52 54 4 other signatures 16->54 22 RegSvcs.exe 18 16->22         started        signatures10 process11 dnsIp12 40 exo-api.tf 104.21.84.169, 443, 49729, 49736 CLOUDFLARENET-CloudflareIncUS Canada 22->40 66 Writes to foreign memory regions 22->66 68 Allocates memory in foreign processes 22->68 70 Creates a thread in another existing process (thread injection) 22->70 72 Injects a PE file into a foreign processes 22->72 26 mountvol.exe 6 22->26         started        signatures13 process14 dnsIp15 42 www.google.com 142.251.152.119, 49733, 80 GOOGLE-GoogleLLCUS United States 26->42 44 dns.google 8.8.8.8, 443, 49738 GOOGLE-GoogleLLCUS United States 26->44 46 2 other IPs or domains 26->46 82 Unusual module load detection (module proxying) 26->82 signatures16
Score:
71%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d8e869aabde78e5fc214c93fb73ccf6b4853613906595b032a971162e28e6474
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8e869aabde78e5fc214c93fb73ccf6b4853613906595b032a971162e28e6474/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3dugtkv546hf7qquze73opgpnnefgyjzazmvwazks4iwfyuomr2a._file
Verdict:
malicious
Label(s):
EvolutionRAT
Create hunting rule
Link:
https://reports.threatray.com/6d5eb91e-3f20-4c9d-96e7-3be9ad549d51
Result
Malware family:
darksiderat
Create hunting rule
Score:
  10/10
Tags:
family:darksiderat execution trojan
Link:
https://tria.ge/reports/260811-wvhm2sybjh/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
Executes a VBScript file via the Windows Script Host.
Suspicious use of SetThreadContext
Checks computer location settings
Detects DarkSideRAT
Family: DarkSideRAT
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DarkSideRAT

Visual Basic Script (vbs) vbs d8e869aabde78e5fc214c93fb73ccf6b4853613906595b032a971162e28e6474

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3823218/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/80386/
  
URLhaus
https://urlhaus.abuse.ch/url/3626692/
  
URLhaus
https://urlhaus.abuse.ch/url/3823206/
  
URLhaus
https://urlhaus.abuse.ch/url/3823229/
  
URLhaus
https://urlhaus.abuse.ch/url/3823230/
  
URLhaus
https://urlhaus.abuse.ch/url/3823217/
  
URLhaus
https://urlhaus.abuse.ch/url/3823226/
  
URLhaus
https://urlhaus.abuse.ch/url/3823225/

Comments