Pulse Detail — Threat Intelligence

PULSE NAME

DragonSpark | Attacks Evade Detection with SparkRAT and Golang Source Code Interpretation

WHITE AlienVault 2023-01-24 Modified: 2023-02-23

IOCs

MEDIUM VOLUME

Recent attacks against East Asian organizations we track as ‘DragonSpark’. The attacks are characterized by the use of the little known open source SparkRAT and malware that attempts to evade detection through Golang source code interpretation.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1068 T1094 T1001 T1132 T1104

MALWARE FAMILIES

SparkRAT

Indicators of Compromise (2 / 12 total)

All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	aca287384838edf8ebf23551483eaf0e	MD5 of bdf792c8250191bd2f5c167c8dbea5f7a63fa3b4	2023-01-24
FileHash-MD5	e00cb21590e1d0cb89eeb16897be82e7	MD5 of 83130d95220bc2ede8645ea1ca4ce9afc4593196	2023-01-24

References (1)

↗ https://www.sentinelone.com/labs/dragonspark-attacks-evade-detection-with-sparkrat-and-golang-source-code-interpretation/