darkside

General

Target

9b5350dd_by_Libranalysis
Size

56KB
Sample

210519-lnb6h4zqj2
MD5

9b5350ddf895a5051b90a1cc563753df
SHA1

0e45a5f66f5ce300b8c7135450e76afaccc0d332
SHA256

2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5
SHA512

b96a1d383ca4721e3a0481399eb6dee0c1573e1c07140b7ec57c808b89cc6790937e6a7d49c960639a79c5a1bf1595e05834c6ae42c1c6933d2537fb38eaa190

Score

10^/10

darkside ransomware

Malware Config

Extracted

Path

C:\\README.aeef1a75.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 500GB data. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/1SJ1TB6JTW4SEUG6GSN7IVSGERSM5H5M2VZOHQ4PSIVS2AGAQDMT3QVGIFMPM3K8 When you open our website, put the following data in the input form: Key: AEGQm0LSuziR6EFXhFWkm5ydHaVo055sxu90K4t2AwMEvOOqRnLk2MlrKgFxhdHfhYMBZ4qnbFVahkmyigl0bCvC8FPE7bcvjvpKgCi60TIIQwRiWAf2wTvA49hUnvV1rt9jkvfcoUvFA6Lehz75q75pr8afu7awEM4TWJrpGoyrJMmb38VEB4SL1U5CcAIo1NirjYoAajFEXB7ibtzv8sRMJMJYK0VgydH2mvnHGmk8iArP8jyH0zVMosuhPKJUkHzUk7kJ2TamCDFDtw0XPm5a4Uz7ug3GKyAeivQwvm1pSW7HODKDPOgZatREFUc6fl55ae3eAo986ywXejXmcvmEz0CCUsbRJM1byvbd0J0AuJeDJ6PshlqqvTs9tqsgZ1cs1MHtizENUPNb05Q131pGkuYSEXOCJHQy6xnswVkd2nWwHPpHAq0Y1P3dlCO2KZL76jdxnM4SNIC9nPjdBxkp0E8fHGpyb0rqgjlgyvvZBPxgktI1jPIfKe9fVDGfTzFZIRWabA6CIyiAjXu14Q4Z1raKZb6ntqxAumNUZ2iLeUXWo5jQcMD !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/1SJ1TB6JTW4SEUG6GSN7IVSGERSM5H5M2VZOHQ4PSIVS2AGAQDMT3QVGIFMPM3K8

Targets

- Target
  
  9b5350dd_by_Libranalysis
- Size
  
  56KB
- MD5
  
  9b5350ddf895a5051b90a1cc563753df
- SHA1
  
  0e45a5f66f5ce300b8c7135450e76afaccc0d332
- SHA256
  
  2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5
- SHA512
  
  b96a1d383ca4721e3a0481399eb6dee0c1573e1c07140b7ec57c808b89cc6790937e6a7d49c960639a79c5a1bf1595e05834c6ae42c1c6933d2537fb38eaa190
Score

10^/10

darkside ransomware
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2