General
-
Target
1d4c0b32aea68056755daf70689699200ffa09688495ccd65a0907cade18bd2a.zip
-
Size
54KB
-
Sample
210513-58ef37q8ce
-
MD5
5da4034b11f506a92698cb2e5255d03d
-
SHA1
d0d30030c619d190492366d8721057738149d4cf
-
SHA256
bfa618d0d4f6ad7c98c588e4826a38391544520d4478e28c77ef29018c167516
-
SHA512
330c87c2eaf76b8e3f127af9056f4a4f3e18c9699521c4959a36ccfb47302129a3a36d1b26055d7b4f229e0f710c6110ea8aab567ed2e5f3ae95ffaf857ec116
Static task
static1
Behavioral task
behavioral1
Sample
1d4c0b32aea68056755daf70689699200ffa09688495ccd65a0907cade18bd2a.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1d4c0b32aea68056755daf70689699200ffa09688495ccd65a0907cade18bd2a.exe
Resource
win10v20210410
Malware Config
Extracted
C:\\README.aeef1a75.TXT
darkside
http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC
http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68
Targets
-
-
Target
1d4c0b32aea68056755daf70689699200ffa09688495ccd65a0907cade18bd2a.exe
-
Size
60KB
-
MD5
c4da0137cbb99626fd44da707ae1bca8
-
SHA1
a38e9891152755d9e7fff7386bb5a1bca375bd91
-
SHA256
1d4c0b32aea68056755daf70689699200ffa09688495ccd65a0907cade18bd2a
-
SHA512
dd8212ff73522c6590ff8d8a3a48276fd872649eada2315b045c8c9f6cf054c3fe6cd741a16744eb82eff763acb745f07336c44db8f0c693770180cf7fd90645
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-