General
-
Target
47d19d8876bd39f1038746379dce3926.zip
-
Size
32KB
-
Sample
221129-nzh6dafc94
-
MD5
8fed3b1445028e329907f91fb4be363e
-
SHA1
6c138515e5db18d14effb429f608ec4936ed9d0c
-
SHA256
90b7fa77350b6b3abbcc97530f020488b7b2c1085e221cdf06eed5b303c50e61
-
SHA512
f309b7536db3ac7939f0037644e9caa79d1f6f7b45738f7379da6ccbfa438b86805366b4270166f45766ebb5aaccb0a7850a6a20d565bc64bd70a26de869ef9d
-
SSDEEP
384:hax/9Bnu5jHLqfcpHu6KPYD/T6DfeVWfQwFb8WpMAaKIgur4xU0D5hlrxS25ujzW:haNKnO6Kkb6Dh5lSAaQUG/vsX/uEyqIn
Behavioral task
behavioral1
Sample
47d19d8876bd39f1038746379dce3926.exe
Resource
win10-20220901-es
Malware Config
Extracted
C:\\README.d61cea8e.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Targets
-
-
Target
47d19d8876bd39f1038746379dce3926
-
Size
33KB
-
MD5
47d19d8876bd39f1038746379dce3926
-
SHA1
2401210fe6a163da4a873d2650df73a73d190236
-
SHA256
a82aec54cad176b368967fa8e41e41a8129ffafe6ab627312e111e63605b8478
-
SHA512
8180be15f2d3e4203fad7e9bfdc0488feef2e205cf407c383d9f3bf4c846a17133b22048cd442d870a1993a1e10706467eb6334331dd46d006e8ffecb60358ef
-
SSDEEP
768:WL5FXM/yQkMoKBFYQpP7zvoqskGvfIoTMSkaRrWzn3gAMi0WC4I:Ec6Q6mRAqskGvfkaRrWzXrL
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-