General
-
Target
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.zip
-
Size
33KB
-
Sample
220426-c9me1aagd5
-
MD5
8342a5908649b0c4e6896f948b5e4d3b
-
SHA1
7d88ed029ea33c08bf6a1b4b723a9f53d6ab2c6d
-
SHA256
0c1f2f914e5b512df229ffea8a27078ddcf992eb175fc05d02aa3bc3fe29a932
-
SHA512
6798f1a6869d934fe61557ee316bfb54de6d039fef38ee760e9a42f40612f6ebda319c6a6a6f7ad1c54ce70107816402366857114dde4eafea6698da5730a157
Static task
static1
Behavioral task
behavioral1
Sample
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
C:\\README.e8d35568.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Targets
-
-
Target
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
-
Size
56KB
-
MD5
3f2cb535fc5bc296aa5b0d2897c265d0
-
SHA1
c30358563fa940eb5cd6064d4d16defee43b0310
-
SHA256
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
-
SHA512
6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-