darkside

General

Target

43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
Size

59KB
Sample

220210-nx72qahabm
MD5

f9fc1a1a95d5723c140c2a8effc93722
SHA1

ce2480dec2ee0a47549fad355c3cf154f9aab836
SHA256

43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
SHA512

3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11

Score

10^/10

Malware Config

Extracted

Path

C:\\README.27a6f0b5.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/DZYNTXY9RP5P8DQ96EFKV2YTOVAMA3VVHL5V0RASUBLBWZGLG51U4LOOBSHV9R0Y When you open our website, put the following data in the input form: Key: k1xICnEwA8i4Exaf4zIjmEWUAK2JUsPppp7hmFIkcNOrmtfztXYRZSKEorEsHiVAg8gIcnQe7gLRyHyJg5knONhaC09HlFh6pr8Ze6Q8hGhKCm2s2OSBStASleEhgnzUaPkJzRNcaENVKONFOZjCg10YHEjNrfuE8JawoVmpQrws6XsdgiXD2E0D1VwxTCAMsDjMY7tpNOgBqY8NWoFYIWhkEoCDjp52OTKNCZfBSR3uinUDqXkUMApbz6JQ00VdTlJqjBH4QS7o73lU2Vtbr7CkQR9q5nXYLlgMKZUNiH4p0dWISOfEHmJWaWIeK1xkMIqqeao5CMf9enqc3xAG4zfW3iaUEQBwS0cDkv2aQCPFHARd71L9sZAtjcedVolkwYUqnBA9HiZRzoX7CmyX1D99XvN4HCzUmSYm0Nzr3goQSB1obYAKoKomDRTtZpLnTblmRkQoYj4dOJFiiXEdA7OswuJUeavsdO8v2XFzweyVNRNLcFy0v6OtQtRxklvgLBy4zztKaiNz7WUBzS2J5HlC7gwpnLclBloh07Bz0AI0clGIWLZf6kb !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/DZYNTXY9RP5P8DQ96EFKV2YTOVAMA3VVHL5V0RASUBLBWZGLG51U4LOOBSHV9R0Y

Targets

- Target
  
  43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
- Size
  
  59KB
- MD5
  
  f9fc1a1a95d5723c140c2a8effc93722
- SHA1
  
  ce2480dec2ee0a47549fad355c3cf154f9aab836
- SHA256
  
  43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
- SHA512
  
  3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11
Score

10^/10

darkside ransomware spyware stealer suricata
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- suricata: ET MALWARE Observed DarkSide Ransomware CnC Domain in TLS SNI
  suricata: ET MALWARE Observed DarkSide Ransomware CnC Domain in TLS SNI
  suricata
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2