General
-
Target
adcb912694b1abcdf9c467b5d47abe7590b590777b88045d10992d34a27aa06e
-
Size
59KB
-
Sample
220131-gprlfageb9
-
MD5
222792d2e75782516d653d5cccfcf33b
-
SHA1
2430f63c64d3e26b13ec4752d8976ff9c9dbbd1b
-
SHA256
adcb912694b1abcdf9c467b5d47abe7590b590777b88045d10992d34a27aa06e
-
SHA512
41233501b78c2060f8a5bfe513b45e1c4dcc510b922ec160b149b69254e90ffd1f54b5c4ed37cd3ad2129dd1227871fe41a7ff3cd47a0fb5354ca7ef812b4123
Static task
static1
Behavioral task
behavioral1
Sample
adcb912694b1abcdf9c467b5d47abe7590b590777b88045d10992d34a27aa06e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
adcb912694b1abcdf9c467b5d47abe7590b590777b88045d10992d34a27aa06e.exe
Resource
win10-en-20211208
Malware Config
Extracted
C:\\README.27a6f0b5.TXT
darkside
http://darksidfqzcuhtk2.onion/61XCW6PKCUTDV5AZD8WK1JWU84BJBWSI25DGLKZ6O6STDBITLAFAH3X1MSRQGRBS
Targets
-
-
Target
adcb912694b1abcdf9c467b5d47abe7590b590777b88045d10992d34a27aa06e
-
Size
59KB
-
MD5
222792d2e75782516d653d5cccfcf33b
-
SHA1
2430f63c64d3e26b13ec4752d8976ff9c9dbbd1b
-
SHA256
adcb912694b1abcdf9c467b5d47abe7590b590777b88045d10992d34a27aa06e
-
SHA512
41233501b78c2060f8a5bfe513b45e1c4dcc510b922ec160b149b69254e90ffd1f54b5c4ed37cd3ad2129dd1227871fe41a7ff3cd47a0fb5354ca7ef812b4123
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-