General
-
Target
2c1e20a4b38634b97de398246bc3c8082d47663702a46bb885dc7fcc5f71daa1
-
Size
59KB
-
Sample
220124-at8besgge7
-
MD5
6957d10b51d89a2a52eede8b7c3b8472
-
SHA1
80071ebdbfbe962a124f54495b7e6082f2cb6051
-
SHA256
2c1e20a4b38634b97de398246bc3c8082d47663702a46bb885dc7fcc5f71daa1
-
SHA512
c1b3680ff3d6d312ecb71bb421ccab6f4aea04e267db6dbe35a46b9a57980092005922066fdb7d1bb7b2e376bde706caa77a56553cdaea64f96b6c4997d1b018
Static task
static1
Behavioral task
behavioral1
Sample
2c1e20a4b38634b97de398246bc3c8082d47663702a46bb885dc7fcc5f71daa1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2c1e20a4b38634b97de398246bc3c8082d47663702a46bb885dc7fcc5f71daa1.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\\README.5bede5a3.TXT
darkside
http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT
Targets
-
-
Target
2c1e20a4b38634b97de398246bc3c8082d47663702a46bb885dc7fcc5f71daa1
-
Size
59KB
-
MD5
6957d10b51d89a2a52eede8b7c3b8472
-
SHA1
80071ebdbfbe962a124f54495b7e6082f2cb6051
-
SHA256
2c1e20a4b38634b97de398246bc3c8082d47663702a46bb885dc7fcc5f71daa1
-
SHA512
c1b3680ff3d6d312ecb71bb421ccab6f4aea04e267db6dbe35a46b9a57980092005922066fdb7d1bb7b2e376bde706caa77a56553cdaea64f96b6c4997d1b018
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Sets desktop wallpaper using registry
-