General

  • Target

    12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975.sample

  • Size

    59KB

  • Sample

    210726-acfa79lw22

  • MD5

    c830512579b0e08f40bc1791fc10c582

  • SHA1

    2fc8514367d4799d90311b1b1f277b3fca5ca731

  • SHA256

    12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975

  • SHA512

    b8e7dc2b26ff00c43dae3e5ceb2b241bc7211c52fba167f1dfd81b285461fd53668953ede798a5f4fd1c587ee9861c2ca0fd034a958428dd3d9f5177c61b5ca3

Malware Config

Extracted

Path

C:\\README.341d6443.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then full dump data. These files include: - finance - private information - partners documents Your personal leak page: http://darksidedxcftmqa.onion/DWMRLAW/N9N6W7_4EpBFAgHXuDGQwpXTQSpdXdKqYN_rPUXHIsXGkuZCNNHvRC8amaoegEAh On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/WKWM6ZXNBVAFW62I1RTLLD4A82OO2O7NBOKLF05CRB4BD06IRBQ0MFA9ZFAKDZH2 When you open our website, put the following data in the input form: Key: LLMNoy1cxUU5F3v2Zv7YhAQxOzdaQF3sOKD9aqFmUCkPeGBCvfM2DiV1zVX7HtYMs8QFQS4jxs4WPZiBVqJwAF5F0pA5SABPG1siAW3c69erGlmUdjURFkmncQQ2FLnzvc3AK1BCuDaxVO2DVr6X5itNLmAtbEKwlUGvyl1oYoSzeIrHqYHTZ5lhhHjuT2UaWJuCJv6wQuEJsolQ2aAZtiM7PZh7AKUR4DdKRaRe3TMOUrm2xnvQ3pZXFRuMTewibx6wmtxLJjTqxJ1Yr5hiJ4uhkOUrni5SxDvlt0bC5dk4eQtIDP2xICeMOYjrLCPpC2hk0JTpp8azhIUZbjy9fXBg0mhuGNufnTPYXtE4RYKCOb7ZphasVglR8j0Mo4JGTRiff1BB9DjCClsf1S9RS6vAtHlLudqyyhmWwURQeS4JSNlZTjOUJUUzvM3S8LXnNAqoX5qtLMXUjiYuMuDwnFQPcvTgK0j8ewGtxNI63ObxyvvVV4Ya4ALZNqA3tO76TcjrW294C3yZcEfFLvv9JUJ0jnDtNEPNGyN1wQUPkTeNZ1Z0LVa5MRP !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://darksidedxcftmqa.onion/DWMRLAW/N9N6W7_4EpBFAgHXuDGQwpXTQSpdXdKqYN_rPUXHIsXGkuZCNNHvRC8amaoegEAh

http://darksidfqzcuhtk2.onion/WKWM6ZXNBVAFW62I1RTLLD4A82OO2O7NBOKLF05CRB4BD06IRBQ0MFA9ZFAKDZH2

Targets

    • Target

      12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975.sample

    • Size

      59KB

    • MD5

      c830512579b0e08f40bc1791fc10c582

    • SHA1

      2fc8514367d4799d90311b1b1f277b3fca5ca731

    • SHA256

      12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975

    • SHA512

      b8e7dc2b26ff00c43dae3e5ceb2b241bc7211c52fba167f1dfd81b285461fd53668953ede798a5f4fd1c587ee9861c2ca0fd034a958428dd3d9f5177c61b5ca3

    • DarkSide

      Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks