Behavioral task
behavioral1
Sample
2023-05-30_dba3994cc3f5a5ca48e04746f9ad11d6_darkside.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-30_dba3994cc3f5a5ca48e04746f9ad11d6_darkside.exe
Resource
win10v2004-20230220-en
General
-
Target
2023-05-30_dba3994cc3f5a5ca48e04746f9ad11d6_darkside
-
Size
223KB
-
MD5
dba3994cc3f5a5ca48e04746f9ad11d6
-
SHA1
2be06e0d12da8e5b1875504ae85571bb70eea0aa
-
SHA256
a9abab8ab44ccec6321da83d9960a1f30ba783e02b6e0ba3f2e9d19cee76b39b
-
SHA512
b5a030e660c0f0d1cfedb0a47e10adf411ff63ee4d599be43a2c6bb1c83727c781626acd8809032cbae4b20308386ab4361c863cde8063262c1486b8472b3a4f
-
SSDEEP
3072:Svz3lYlRlG9JpdDsNh1M7tqJogYkcSNm9VoDPyhnBhMFE5fv0PfFYZZU:CzVXpdDs/1MBq2kc4m9iDeBkEt0PfaHU
Malware Config
Signatures
-
Blackmatter family
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule sample family_lockbit -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-05-30_dba3994cc3f5a5ca48e04746f9ad11d6_darkside
Files
-
2023-05-30_dba3994cc3f5a5ca48e04746f9ad11d6_darkside.exe windows x86
d2e26e45dcb84f1062f90f29a9cf0faa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxW
kernel32
LoadResource
WriteFile
CreateFileW
ExitProcess
FindResourceW
GetCommandLineW
GetFileSize
GetModuleHandleW
GlobalFree
SizeofResource
LockResource
ReadFile
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
sprintf
strchr
strcpy
strlen
strstr
wcscat
wcscpy
wcslen
wcsrchr
localeconv
_stricmp
_strcmpi
tolower
realloc
malloc
free
strtod
strncmp
imagehlp
CheckSumMappedFile
ntdll
RtlFreeHeap
RtlAllocateHeap
NtClose
RtlImageNtHeader
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 438KB - Virtual size: 438KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ