Behavioral task
behavioral1
Sample
2023-05-07_59fe569fcc6b84aa8e8e74236fc8d8e2_darkside.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-07_59fe569fcc6b84aa8e8e74236fc8d8e2_darkside.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-07_59fe569fcc6b84aa8e8e74236fc8d8e2_darkside.exe
-
Size
3.5MB
-
MD5
59fe569fcc6b84aa8e8e74236fc8d8e2
-
SHA1
c9c71661709bdd9f9da212bcd5bb6373cb1e58a0
-
SHA256
f7c432afe20c31ddd75dbb214f1b7aaeb400d9d17da6d9e3c0d7cf1dd38bf524
-
SHA512
e06ebb09e4395303bdc5918b2c8d0cc8620b3878a87a8d64e5d1c3345a9a2e7b6bf4d3a370d68f44adf56989b610a1fe9a48bcb9855a4866186c67860ef5478c
-
SSDEEP
98304:RkYcyokoQj+a0TVYVxNqkdrIc3zoZbNcMlC:RkLy/+/VMx8YIyzabNcMlC
Malware Config
Signatures
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule sample family_lockbit -
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-05-07_59fe569fcc6b84aa8e8e74236fc8d8e2_darkside.exe
Files
-
2023-05-07_59fe569fcc6b84aa8e8e74236fc8d8e2_darkside.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ