General

  • Target

    c718e6eaa1a446e0a3d72b533b3552c4419e9e2c646e48a5cbfeb6a7ee88c3dc.zip

  • Size

    133KB

  • Sample

    220105-sncaxaaea6

  • MD5

    c8899b3bb00db07b7b702e3bd0a58774

  • SHA1

    d5d405bc1bc41b036411701315c8a653e8e4d13b

  • SHA256

    684ce737c1df26159dc117c485e1c922db9f8fb3d8dc086da47a6ca18fa43dc1

  • SHA512

    d672633987af383cb23ea844de13f4692d3c1ea58a351e43a7efc7932abaea232a5c6d987d8b43fb0cf31f37bce054cf81535ec48b2bf05e38b82be3ea0c7470

Malware Config

Extracted

Path

C:\\README.5bede5a3.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. DATA LEAK ---------------------------------------------- We have uploaded more than 1 TB of data from your network (Personal data of your customers, partners, personal data of your employees, as well as usernames and passwords of your bank accounts, and much more) If you do not contact us, we will publish all the data on the Internet(Media), as well as send it to all supervisory organizations in your country, your customers, partners and competitors. PROOFS (screenshots): https://ibb.co/j579HKQ https://ibb.co/HNfwBXp https://ibb.co/GTCknt9 https://ibb.co/s559W3C https://ibb.co/LNgjXNT https://ibb.co/r2QJ6fV https://ibb.co/PQBRrTn https://ibb.co/1851npy https://ibb.co/yFWcMsm https://ibb.co/1ZsVP9B https://ibb.co/3CPYZ7K What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/V1WEX06KUR61Z0JUXM0R12HXQK71TWOKVVTURZMSESZQ9V8FI49X23M1NUSCSPQO When you open our website, put the following data in the input form: Key: iI3rucYej9vtW6RUIaeuqHVOoBGRdIKxXO4Wv6Axl8jnW8iJP2eoyc7Mwg7klQDRC7uGVmGdHgDZv1zu9bEEp0Jt80cv0TlJZEXNenwMztumWSiyo4YjnQ63FcMzuCQ3dqMKarFiNRmsI1qPJaOeSSJS15KmmfYmUEaGrLt8xDraIQqGXClouzQAZmWIfxeFm1XLwy64qKLG0DpiJg0wJQKkc2Z98IQsRpAOGWTH8ksiFh4uFyXKviABrEDwdOonazjW0Rk0uOWWxmXL2FQIItr2O5vqqTacTBOLqEbm3noi70I9DchrhaVvHWPx7KVRuKKXWGtsvxUPknckBdZIot96GUFkeIaAczo55ghdJepKNszGKXnAI8WRgu1vKcy6J33p3PMcx1g5qCqOCaZv2hlqEN0quAbekEaJXVGNKGcHVDbepQ0yQeOBzz7OK4GnzChZka0Y3GCsHuSt9NoHhc9XLlxor4bHRhjhgMChls5k5xqEXiPYbXgAuaRNKMhKLs9ePKaORiWTp0x2OPCqiV5x4QhlkNYw1FkpHd2PWXi1rpbCFGfeSda !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

https://ibb.co/j579HKQ

https://ibb.co/HNfwBXp

https://ibb.co/GTCknt9

https://ibb.co/s559W3C

https://ibb.co/LNgjXNT

https://ibb.co/r2QJ6fV

https://ibb.co/PQBRrTn

https://ibb.co/1851npy

https://ibb.co/yFWcMsm

https://ibb.co/1ZsVP9B

https://ibb.co/3CPYZ7K

http://darksidfqzcuhtk2.onion/V1WEX06KUR61Z0JUXM0R12HXQK71TWOKVVTURZMSESZQ9V8FI49X23M1NUSCSPQO

Targets

    • Target

      c718e6eaa1a446e0a3d72b533b3552c4419e9e2c646e48a5cbfeb6a7ee88c3dc

    • Size

      260KB

    • MD5

      ce7b2f7008ab93c659494f2931160147

    • SHA1

      ed2aec7ebbcb87059b707aa98bd300c8d75f3acd

    • SHA256

      c718e6eaa1a446e0a3d72b533b3552c4419e9e2c646e48a5cbfeb6a7ee88c3dc

    • SHA512

      6b81bd235ad199b01ee0801a3e14544a4a720ee0609aaa0df99415dcecf10a114219a96f79f57915701b3f6576ac7259d472519964516a1d92ee4023babab0fb

    • DarkSide

      Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks