General
- Target 5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477.zip
- Size 1.8MB
- Sample211101-sndhzaabe8
- SHA256 5e210a42996ad14924d70184043cb304be7f555a20d8937ae4502e01d4cf33aa
Score
10/10
Malware Config
Extracted
Path
-
C:\Recovery\6e3e77a2-1a56-11ec-8d0f-c222d480bba6\README.txt
-
darkside
Ransom Note
- WINNER WINNER CHICKEN DINNER What happend? ############################################## All your servers and computers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ############################################## We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one image file for free. The file size should be no more than 2 MB. Contact us by email: [email protected] !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
Emails
Targets
-
- Target 5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477.exe
- Size 3.1MB
- SHA256 5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477
Score10/10-
Suspicious use of NtCreateProcessExOtherParentProcess
-
- Target 98272cada9caf84c31d70fdc3705e95ef73cb4a5c507e2cf3caee1893a7a6f63.exe
- Size 700KB
- SHA256 98272cada9caf84c31d70fdc3705e95ef73cb4a5c507e2cf3caee1893a7a6f63
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.