Malware sandboxing report by Hatching Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Darkside.5687806091100160.zip
Size

15MB
Sample

210512-7y9jvkwby6
MD5

86602f27296d6eeb87afaa6e910373d9
SHA1

468c063ae10297277cf02bd84e7f93a14e8cab75
SHA256

89eeac2abad61ef22fd914f9c4efaba04ca830d93ab1611c985531ac6d5e8460
SHA512

cd629265c6b10e86371d36748cf30dc6e118d1a02829da4a0d97d27ccf2b69a97af35b2458e54f8e474b93285fdaeba922619af24a020938a8e75a391020a744

Score

10^/10

Malware Config

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 90 GB data. These files include: Finance data Insurance data Buchgalting Data Banking data and details, bank contracts, creditors info Much personal data Marketing data Production, Technik data Email conversations dump and more others. All documents are fresh (last 365 days) and stored on our offline servers. All data will be published piece by piece. First data pack will be published in 7 days if we do not come for agreement. Your personal leak page: http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF On the page you will find examples of files that have been stolen. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH When you open our website, put the following data in the input form: Key: rIzr2nCuqbQL7MGMwoppaucqSp5AZufUiYhssYa1SGfO0XFf09fBDlLDWgKQSnnvIAfqYTsOgUhOTxzbxGsC9nH0yk2HOFhn7t8ntX8L0evyce8vKdgUKF7Xvjn6ljaQQ4HPEfPZFP2jvN0DgBVWl2WgNT1U3owZ1bNBjps34t33ObZc01Ce1yKx5CSlwUYbw1ktjqt5d7R9DwRL3NIGrTHvMX3qXI5aBAUnirnc4zHtfGPXq4CuFoh04Tv7VE81aohfvuz8D7wo7i28sbILoJyF6mzeQwSkAXolOhXKQAEPsGcdbfLxfY5uILkHB3d1gAyxT1owQXsY4heNQbY3yYL1Em7dDaLdbNhOf0adYWFiFfAl9EwLDRT96L9Xzsk17ho1B82wOWZ79ZqtT8yqnZ4APJb1LO91ASSsgUdNvR0lAaZTfXHHxUI1vDm5ygyV7cbxMlrQ5K1U6ughdd5WosogMJWVNjreirhzuDzY6SnixtukGYG0D9azzgOHcgidJcLV4n0orhzIaA1SMNYOpdOIadgBehCaHwEyr3hn8CEa6fgpUgK6E95 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF

http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT

Extracted

Path

C:\\README.341d6443.TXT

Ransom Note

----------- [ Welcome to DarkSide - I-D Foods Corporation] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW When you open our website, put the following data in the input form: Key: 9NtjyWHbqWYTbhBpJ2ht4tKo7DQgTGmQ4IGHCFvgjiSMTNopVgQ9YIh9KRWkQgmvxviZtJGOakzykMzWKRgxwf2pCxpdMT8iGlKcsSOsxVOUXIGEgpy6tLqliTTEKWnohcYOhCF3DYMePMxEYa0eCmED1EXEG5QOZCpmkgDl5s5VSUF5uhnKsunUtKGS24iEAr2hxsJ1zMcMHmKVrf3bvRyhYVKXwlXVggxE7ncowldcK3v3CiKC24jKVd6OH5QrhVyyQLrFM5RE3Y0RcTeRTIqf1J5CIEhTiG3TH7SEpws4wfkt9RZ7rBWT4n3B69Z9JuPzyFCBwPKF7gTzEYzixIGzFbJyLSZXff9ryv3yL3JeKywAcoBafos0dLSkRgf1X1a1S2ud4kXa5GRU4W7rhCQsnJ8vAcv1AXaPRq9ESySBWQdGCQMSci0ex0oE4EfCDW3jjyXtaPofqNFhibodJFmOyTKwie1OcW6Kh6Ih6JxXXfUXr4VbRILzsiPXsOTTisDaEicID1E0SJRluBus2UhPyogJiZ7UpmUu9LUe3yAi3Bhox3pLv8E !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 37GB data. These files include: - Office - HR - Tax Confidental - Finance Your personal leak page: http://darksidedxcftmqa.onion/blog/article/id/62/HaER8VXDfRbMaspeLi3Za1LoRutpsd_nKm-yHc5RAJk1xxMFe2jnOQlD70US6XCT On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/SN8W532EY9MVOD09H4HBVZ1RI9RS4AATPO11NCDX0JKZ7GAPU6K6CV3CVLSS2NMH When you open our website, put the following data in the input form: Key: XMBN2NXBcASwNZe2y0u6Ty85zTQbIDUSEUQC05GXqrgGHcKS32we7VMDJPqr1uhgc15HqzScoT9CtNH8J0C8gU83Y14hWndBD65NxvnEpPJVdxcX840aQs2l0JH4Y3gaGTkLfYt1TQLKbgPAmS3nXg3eJapHm7ccbb2ggSgSDnik8nt6KP2Ol3STOpHdWA4eBw1W47PJYZZptMLgthDW098Dlf73wTCaHi0fmedIcHVcoE8SpYYACKiyApeWQqHkWLketZrGTd3k0hTVkCJ16nUoiNkpLMAxAxEAnPTWydYFabnk7jz6cJBrxjOA4HAQCaKIqr5AzL5ArFROpXxuT5Zn71BiDnCwQGCmZO5PG6OJITvblzcS9eWvVPUWsDqVWkNXqco2ulxf0oefiPyt8oOcXcdOZQdEh0TvOdXzh7tRS0nYWcAkQLTdqz5JQEJetzsQPvnokvKb2Jk58Dbl9pesPTw3K4unS5GHOifTDRxvO2Al1VM4TgPUzRZKLQusXzSTRvFOW1JJ1sO9Ixl7HnozD51emn3ekYSE0WdSyQr2p7Dlrr97TMt !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/blog/article/id/62/HaER8VXDfRbMaspeLi3Za1LoRutpsd_nKm-yHc5RAJk1xxMFe2jnOQlD70US6XCT

http://darksidfqzcuhtk2.onion/SN8W532EY9MVOD09H4HBVZ1RI9RS4AATPO11NCDX0JKZ7GAPU6K6CV3CVLSS2NMH

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/DZYNTXY9RP5P8DQ96EFKV2YTOVAMA3VVHL5V0RASUBLBWZGLG51U4LOOBSHV9R0Y

Extracted

Path

C:\\README.98239029.TXT

Family

darkside

Ransom Note

----------- [ Welcome to Dark ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 100 GB data. Example of data: - Accounting data - Executive data - Sales data - Customer Support data - Marketing data - Quality data - And more other... Your personal leak page: http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68 When you open our website, put the following data in the input form: Key: pr9gzRnMz6qEwr6ovMT0cbjd9yT56NctfQZGIiVVLgo0ME2EQpAUyZucG9BLrOJjno5XLPvCN11TFfnlFHa42u5mJxoeR5k5RUgQAC1MC6LBUj4YOOAUyiBrR HQSUM3pzGoEPRVOzXSZ8YqkJyFL0TDFBbWaBKQDOSo9GzKKoVRQ0Eb02F5geTPkTAqZZSfSQ6PBBlTGPSgGe2kCyuwwp7lDmRSJlNnHssMMZHVhXzyZ6fxiBY gNiuusFK8JNI5nrtRPp3bMAc6OEddxfJWj6o2GT1Xg9j87Jp4Oyv43E1J61jLJAWBkmoBB3Gqv07mtyDW5PnmxBlNzABbLFEvJMQL23sR8nnw4svzcZHxrqD1 xRcxqyeKtsaQ5yqLvyQgMdnrI2QoCqkHYYUfBIzjO8BXyBZdmjHanXE57jdDAhjaDUUqfL917cCyJr1uwVR0Xj5lJXe8BIKHd3dFrz70CsIXFAhicOsBlFzIn daNcAXXyL8Fg1avIXOcuEkGRDXt8Cs8b3TAB6n4DrbLJdiFjECo8yCA9pxvzqjXatumUloblWFZaUoLVYzP !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC

http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3

Extracted

Path

C:\\README.949640ab.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 500GB data. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I When you open our website, put the following data in the input form: Key: I3tBdXvJ3pOvnhgmupZAJ7BpD5IVUftr7deEdtoxwK0QcbZciUXfs5ChjD0Yj8H2wUXfctFHYShVQHWhwi1CBDRQVPgXqnCgVRQql7B1tS8Q6TSdHq5o0UxOaDrdKCoMCdrMZiw0RTbfpDpuRwLI52rP5YaqZx492wErocN9C7PE6eFQEcqwqiFNA1FwVD3fogTJqOdTJI84FnlCBuRd1ippdTk8y2x16ukfPvVHi4MhyU8i4K1Q25a7wXQUPXhIffgZBnTimLzalSGyaI3f2MlQeYbpFG2o4nfnZCHDMAZAUY6CaiR0eAYVEvesreMmimT1EOyGYjNVtGHrJYXuRI4tYZIVlsHm6Ord42NV9s9PftLGkO8NBScZ9dBTNtz0xw9tpgu8GegVTlMesg6xkUAQWJcy6MNt9nJ7lHydpu27bA1GL8MX8lWAldnClSoUrDYRc8RAZ1oUfMfbtmvMDBGVENh8kMUYaxOt7hD1HxKFn0p5XcCDzWRSWkKUTtt7C6OiIpNOUAYYJ3UvC5S3uoXmt4iokkGq1SSMnr7sXmnekmh9oNwJgh7 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/VGBU8VAXXW7EYB5U4KQJXUGU5NT5FP8208W6UXVSKQDAE3CNBR4JTZQCXEZFZWF2

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/45NAQ3FNBX002JPHBAIKB97JVVABJQHTM2HO7XOZRXTEH98CRPXYX09X7VUH0F0W

Targets

- Target
  
  1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43
- Size
  
  40KB
- MD5
  
  1a700f845849e573ab3148daef1a3b0b
- SHA1
  
  c91ff86a88038b00d9190ebb01e6f8c94b0c83e0
- SHA256
  
  1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43
- SHA512
  
  d7fcf0ef26bbe1d6104c098711ccdfd33655e62045f6975dd3c48ab34888c83b771dfd07682004943bab86b2dbcb7905364becead09c37de3da0b28e8265dc81
Score

3^/10
behavioral1 behavioral2
- Target
  
  17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
- Size
  
  59KB
- MD5
  
  cfcfb68901ffe513e9f0d76b17d02f96
- SHA1
  
  766b30e5a37d1bc8d8fe5c7cacc314504a44ac1f
- SHA256
  
  17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
- SHA512
  
  0d26fa9478f4626107e38c570d1bae1049b744181cf0395d95fb07675575ca393d88d4783bf31bdf11bef1da5648a5a53a6d95b21492f96b4de35c0ec323ae0c
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  
  1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb
- Size
  
  59KB
- MD5
  
  6a7fdab1c7f6c5a5482749be5c4bf1a4
- SHA1
  
  4e6d303d96621769b491777209c237b4061e3285
- SHA256
  
  1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb
- SHA512
  
  39446ebfae1dd0e007e81087f42021b95ee5a0a04e22ca7f4f5addbea4e71c7fe09ffd3bf953400955ce6d31b535c81a37b018aba73c30e61575b2c49414d6cd
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral5 behavioral6
- Target
  
  243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
- Size
  
  59KB
- MD5
  
  0ed51a595631e9b4d60896ab5573332f
- SHA1
  
  7ae73b5e1622049380c9b615ce3b7f636665584b
- SHA256
  
  243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
- SHA512
  
  9bfd6318b120c05d9a42a456511efc59f2be5ad451baa6d19d5de776e2ff74dbee444c85478ee7cfdbf705517cc147cd64c6814965f76c740fe1924594a37cb5
Score

10^/10

ransomware spyware stealer
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral7 behavioral8
- Target
  
  27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f
- Size
  
  59KB
- MD5
  
  3fd9b0117a0e79191859630148dcdc6d
- SHA1
  
  cf04fa736baf22a2ca4e67f1c7723f1776267e28
- SHA256
  
  27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f
- SHA512
  
  c5175720f432c157eb34da92b29a15f1d7cee77240be12289d5cdb52419dd448b2081a579f783fd48d6226d49057eb3e79f38d85d335761089386a621d1419de
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral9 behavioral10
- Target
  
  3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6
- Size
  
  59KB
- MD5
  
  c4f1a1b73e4af0fbb63af8ee89a5a7fe
- SHA1
  
  5604a48ce74124fb478049976db48197896b6743
- SHA256
  
  3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6
- SHA512
  
  67e6b184b926b1de2fa1d4c429db33b4b4146a0c5eb6929422d6ec161654fc634dce7810a1deb0befdf7d932df1edfc02251d8193272c1d1c713a1df8da32ceb
Score

3^/10
behavioral11 behavioral12
- Target
  
  43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
- Size
  
  59KB
- MD5
  
  f9fc1a1a95d5723c140c2a8effc93722
- SHA1
  
  ce2480dec2ee0a47549fad355c3cf154f9aab836
- SHA256
  
  43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
- SHA512
  
  3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13 behavioral14
- Target
  
  48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a
- Size
  
  226KB
- MD5
  
  c81dae5c67fb72a2c2f24b178aea50b7
- SHA1
  
  4bd6437cd1dc77097a7951466531674f80c866c6
- SHA256
  
  48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a
- SHA512
  
  30d63e080f37f34fb29fd46f8fb1572d79f645154a002c8da5914ae3d51e224bc60601f91f5d58ac2ce9f81d56a8ad467d7fde55d429ed269df3c196e6687b2c
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral15 behavioral16
- Target
  
  508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add
- Size
  
  59KB
- MD5
  
  69ec3d1368adbe75f3766fc88bc64afc
- SHA1
  
  11936a92144ef1b53eef16566a57b9052d173291
- SHA256
  
  508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add
- SHA512
  
  58f0f04cb05221e9a50eab89924c45bccc15045e9552e10f39ebbb651eddc5d4fafd95a1ba80f4a6ab8d23c4d3dfff7669e2499650b328420c766cae82e439e8
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral17 behavioral18
- Target
  
  516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
- Size
  
  56KB
- MD5
  
  84c1567969b86089cc33dccf41562bcd
- SHA1
  
  53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2
- SHA256
  
  516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
- SHA512
  
  72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa
Score

10^/10

darkside ransomware
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral19 behavioral20
- Target
  
  533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d
- Size
  
  59KB
- MD5
  
  0e178c4808213ce50c2540468ce409d3
- SHA1
  
  38b5aa765026dffbb603e323333294b5f5efa5ee
- SHA256
  
  533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d
- SHA512
  
  262a8f4808f6c3499c9eb465b480508ed6b082ddd36cf2e618a9455b5abbc2eb6a8d7b7c2f398faaa62ffb22599a8b2eec0d3137fdec648de37ac4a73e6f44f4
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral21 behavioral22
- Target
  
  6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff
- Size
  
  59KB
- MD5
  
  5ff75d33080bb97a8e6b54875c221777
- SHA1
  
  810d6c70a96584486867cedde111a1087ed1ebe7
- SHA256
  
  6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff
- SHA512
  
  a6b87ddcaa797a4d8abc06a786a7186fe43eef5e3291402f81b95a180b7fb746f88cd0f408a089deb5321ecf0d2ac3cca479fdc1f782771749df0ac5a082ac00
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral23 behavioral24
- Target
  
  6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8
- Size
  
  40KB
- MD5
  
  1c33dc87c6fdb80725d732a5323341f9
- SHA1
  
  0aea126a9d01fc5faf06314529b4ff06fdc6f8cd
- SHA256
  
  6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8
- SHA512
  
  50f915e355e66c264d1eaad3bda01034c99ddc8fdc78b03c653ef0ccb4a250e3d892c3b6131fd153c5b73b0ab7c6649c8465ff8dc02f42efb050f8f76906197b
Score

3^/10
behavioral25 behavioral26
- Target
  
  68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7
- Size
  
  59KB
- MD5
  
  9e779da82d86bcd4cc43ab29f929f73f
- SHA1
  
  e6b47869caa776840ab79856b04096152103c71d
- SHA256
  
  68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7
- SHA512
  
  e0a172b862054b63c26e8852019cbd46b68c6102e4bae802ba851ae950798d336295795c0cc5d68002a0467c62e5800f1ecfdae05de2709d57bcc31375276bb7
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral27 behavioral28
- Target
  
  691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5
- Size
  
  59KB
- MD5
  
  e44450150e8683a0addd5c686cd4d202
- SHA1
  
  8c482a0eed33c8a4542c3cb2715a242f2259343d
- SHA256
  
  691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5
- SHA512
  
  7d65d22ad630fd77c50e277a44fdcc46fa86235c93524f9751ac9ddf0ce19261707fab631108fc908a71029900dbf6ada119d607edfadc3ce309f86a9c3765fe
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral29 behavioral30
- Target
  
  78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134
- Size
  
  59KB
- MD5
  
  47a4420ad26f60bb6bba5645326fa963
- SHA1
  
  7a29a8f5e14da1ce40365849eb59487dbb389d08
- SHA256
  
  78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134
- SHA512
  
  08c82585fbab8e090e67e4571f7428bffaf68f9a8c2e34b72f9688205ee880a6435aa813b8845a0b0281c80b78774b969032cc27fc98d3f0e67116dabcf77127
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral31 behavioral32

MITRE ATT&CK Matrix

Collection

Data from Local System

T1005

Command and Control

Credential Access

Credentials in Files

T1081

Defense Evasion

Modify Registry

T1112

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Execution

Exfiltration

Impact

Defacement

T1491

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

DarkSide

Modifies extensions of user files

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Modifies extensions of user files

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Modifies extensions of user files

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Modifies extensions of user files

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Modifies extensions of user files

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Modifies extensions of user files

Reads user/profile data of web browsers

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Modifies extensions of user files

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Modifies extensions of user files

Enumerates connected drives

Drops file in System32 directory

Sets desktop wallpaper using registry

DarkSide

Modifies extensions of user files

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Modifies extensions of user files

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Modifies extensions of user files

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Modifies extensions of user files

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Modifies extensions of user files

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4