General
-
Target
0a0c225f0.zip
-
Size
32KB
-
Sample
221020-m156vsaeek
-
MD5
2cdb06b0f1bea8d0e28392d8181e39f0
-
SHA1
292a577213b2ca66b92f71ac277028233f6c8f08
-
SHA256
b6bbea34c85b27d3833fed2f6fb68066ff1daa3abd4940346627fed3698788f7
-
SHA512
4119001a8041954aeee7c39e492e66402dfefdc936139af3760c736da6ab13aefd236bb73e81f7a3fd9fcb8a75ea50dfba955c7e2c3c7e8e8cf29dd9a53b64db
-
SSDEEP
768:rTvgrVoRlboq3QmZpEI7pyp05jaCIOn8jrYTJ0Kl5uVbGil:rTvUoRpKipv9jhagniYV0Kvaqil
Static task
static1
Behavioral task
behavioral1
Sample
0a0c225f0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0a0c225f0.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\\README.fcfbc378.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Targets
-
-
Target
0a0c225f0.exe
-
Size
56KB
-
MD5
979692cd7fc638beea6e9d68c752f360
-
SHA1
c511ae4d80aaa281c610190aa13630de61ca714c
-
SHA256
0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9
-
SHA512
d7b7b6a968e6d7b7f3e7f98decb6b331b08122e491bf0b0dbe243223fb177218a758c34830f20c47f2a799acdd146297ec7f930c2bb4d5c6830ce65c8274ea6d
-
SSDEEP
768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLd9kvAx0:g4HHerjZX7pLjJKjSO5i
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-