Overview

overview

10

Static

static

2d82be244e...f0.exe

windows7_x64

1

2d82be244e...f0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2d82be244e23001148ed5a6d83856b6f7cd20c3f7786481303d5d584c51ff5f0.exe

  • Size

    55KB

  • Sample

    220315-1tr8bagca5

  • MD5

    edb5670581d49771d180940c4d1179b1

  • SHA1

    e691a8ecda87157a9cf96fbe4df8f819922e34db

  • SHA256

    2d82be244e23001148ed5a6d83856b6f7cd20c3f7786481303d5d584c51ff5f0

  • SHA512

    a7fb450f08e68b46288da5f4d2e4d96628161e5aadf01286e3f4f9c045880b0092480431b0a7b1cc22c954a46020b9bd00f5bb3de2dc873c1e202f39d9c6d708

Score
10/10
darksideransomware

Malware Config

Extracted

Path

C:\\README.f6cf1b4f.TXT

Family

darkside

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 120GB data. These files include: - Accounting data - Full dump clients documents for last 3 years - Email archives and conversations -Personal clients data (driver licenses, SSN's an much more) -Employees personal data The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/1YIRHSV68TT7RTL4GR0DT8F0H5J0OVFW64FAB4ROL3ML25HUD7SMAB3MM5L4P7VW When you open our website, put the following data in the input form: Key: SArlcPg1tSSQGQkV3MWvJaMitrO0la6Tp1v7u70m4NCQkJsDdiA2cct8U7h0fxVeYToWov0yA5zsfCsKS30nOHKRkS4Oyr9dI9s848SyAAur8cFrRftlSO8yqUoK9GYdw25OkddGESXb6EE7E4Lm2fJPgiHIIndvkrYG5MrTnWdix1wgKM6ZqBfL9RywKdsa15brDw2d7sAZSUJ56Kw72X6HDzpEmmdp3hN2nq4wLLzRJJAvlaXXAdRHpkuDIAMo9LPaDtEqDH9dUFkbG6zjf3f5JvxFbEjOpGhY1exDaYXq07f0oM1hoPBLL1kVxSAYnoGuyNEIj0gPyzGO4nxEXUTHwO8p5DaXIcDavG3KvCjJ9sbUu00BLYqmYRUCXLnmfj0LO2zmC4F809rx4rlDNzMEvzgBV2WipkU4IxPoQVNe8ButdIaMaEXBCgV9xT6Jv7j6FZ0Tit46lpgUtPJsXWT7RMLPWLfdSc3ebrZx59LszBEj9BjkQ62CbaHk91CF3Dbn0GfeySK98uKIr3YvZhXC4Vv2A6ubkk9sBPe4Z34XICANYi7U6Ms !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/1YIRHSV68TT7RTL4GR0DT8F0H5J0OVFW64FAB4ROL3ML25HUD7SMAB3MM5L4P7VW

Targets

    • Target

      2d82be244e23001148ed5a6d83856b6f7cd20c3f7786481303d5d584c51ff5f0.exe

    • Size

      55KB

    • MD5

      edb5670581d49771d180940c4d1179b1

    • SHA1

      e691a8ecda87157a9cf96fbe4df8f819922e34db

    • SHA256

      2d82be244e23001148ed5a6d83856b6f7cd20c3f7786481303d5d584c51ff5f0

    • SHA512

      a7fb450f08e68b46288da5f4d2e4d96628161e5aadf01286e3f4f9c045880b0092480431b0a7b1cc22c954a46020b9bd00f5bb3de2dc873c1e202f39d9c6d708

    Score
    10/10
    darksideransomware

    • DarkSide

      Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

      ransomwaredarkside

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks