9a18fdec476ae659ae5d79a06c9fdf7f0a36e685430a9bc2b59418604bf785ad

General

Target
Ransomware.Win64.Darkpower.zip
Size 1.2MB
Sample230331-v3jpmsdd4t
SHA256 9a18fdec476ae659ae5d79a06c9fdf7f0a36e685430a9bc2b59418604bf785ad
MD5 2d6920d1aefe09eea7a452ec1da3d9a1
SHA1 05ee1013bfabc5b0bb8e4c1799cb3b4d584792af
SHA512 c8295f953287b383c80570837b888b651cea73a6a344871791c002e3c51da741c7d89f46db706bd5b94aea72b134686e19e917ea6a455577690aa8dfd68546c9
SSDEEP 12288:dWcSuAi35ZgWJD6uh4CbXrv95I/oVUXsc4eUAbL2YkP/GEpcQY+pkGxZ9sG24oOl:BSv/8x9YoWschUCkP/jpCae4vNNrucV
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394
- Size 1.3MB
- SHA256 11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394
- MD5 df134a54ae5dca7963e49d97dd104660
- SHA1 9bddcce91756469051f2385ef36ba8171d99686d
- SHA512 9046be2d1af55141001c8f35b06af2607a329e3b4d97253972362ef4ffb61106be3bf6701cbcc36f1a39028c9f17d19b414f6ee63bc34e4622a5833752a17914
- SSDEEP 24576:fsspRa70Hm5QQF0fTOOqs60utA+islfs/DHEj3TBi0mhwLlz2Ya60xchhH2yP1DF:f7W707QEpq3u+PkDHEj3TBi0mhwLlz2q
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

ransomware spyware stealer
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2
- Target
  33c5b4c9a6c24729bb10165e34ae1cd2315cfce5763e65167bd58a57fde9a389
- Size 1.1MB
- SHA256 33c5b4c9a6c24729bb10165e34ae1cd2315cfce5763e65167bd58a57fde9a389
- MD5 5e55339ce16c718983c435f51967153b
- SHA1 2e72fe42f572d0ed93ac74063877ff6e4e1fa33d
- SHA512 6b122e6a4e7570c271f47b139ac62280afbb03306a8202dd60fd9775d41d83661e3036ea9aafa1b7ac31df4366ffaeb98910efd2fbd2c334c7ef71ca33e3a081
- SSDEEP 24576:G1/uUXmxZLauIytkH+Yz/nchhH2yvrchhH2y+/0mhwLlz2Ya6sncEPyiZtm:euU2LtenrnchhH2yvrchhH2y+/0mhwL7
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

ransomware spyware stealer
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral3 behavioral4

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies extensions of user files

Deletes itself

Reads user/profile data of web browsers

Modifies extensions of user files

Deletes itself

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4