darkside

General

Target

1PGNZ8NZG6RCE9.exe
Size

10.1MB
Sample

230804-v9q3asdc48
MD5

6e6339c7960e973ae81e0bf3a1530f23
SHA1

21b3719fd440d59c5a57800c7a92fadf3c42a258
SHA256

8d51d18c32bfc42a4e1722f885f3c1c03c3eb7de68f8f2df49a5fdb868e8e1ea
SHA512

c5d9750de294db5dc7ee095adc2faa568ae4ee55e6e8db9a0e945f73f9a320a4d30ebda57bd291859a46111d836a7c0bcd4498ed8e8d19f8b7e7fa378117de9c
SSDEEP

196608:+LDna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:MDnaOyRQETSBvJSOq62YHtFHN

Score

10^/10

Malware Config

Extracted

Path

C:\Users\README.c6d30de8.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide - I-D Foods Corporation] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW When you open our website, put the following data in the input form: Key: 9NtjyWHbqWYTbhBpJ2ht4tKo7DQgTGmQ4IGHCFvgjiSMTNopVgQ9YIh9KRWkQgmvxviZtJGOakzykMzWKRgxwf2pCxpdMT8iGlKcsSOsxVOUXIGEgpy6tLqliTTEKWnohcYOhCF3DYMePMxEYa0eCmED1EXEG5QOZCpmkgDl5s5VSUF5uhnKsunUtKGS24iEAr2hxsJ1zMcMHmKVrf3bvRyhYVKXwlXVggxE7ncowldcK3v3CiKC24jKVd6OH5QrhVyyQLrFM5RE3Y0RcTeRTIqf1J5CIEhTiG3TH7SEpws4wfkt9RZ7rBWT4n3B69Z9JuPzyFCBwPKF7gTzEYzixIGzFbJyLSZXff9ryv3yL3JeKywAcoBafos0dLSkRgf1X1a1S2ud4kXa5GRU4W7rhCQsnJ8vAcv1AXaPRq9ESySBWQdGCQMSci0ex0oE4EfCDW3jjyXtaPofqNFhibodJFmOyTKwie1OcW6Kh6Ih6JxXXfUXr4VbRILzsiPXsOTTisDaEicID1E0SJRluBus2UhPyogJiZ7UpmUu9LUe3yAi3Bhox3pLv8E !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW

Targets

- Target
  
  1PGNZ8NZG6RCE9.exe
- Size
  
  10.1MB
- MD5
  
  6e6339c7960e973ae81e0bf3a1530f23
- SHA1
  
  21b3719fd440d59c5a57800c7a92fadf3c42a258
- SHA256
  
  8d51d18c32bfc42a4e1722f885f3c1c03c3eb7de68f8f2df49a5fdb868e8e1ea
- SHA512
  
  c5d9750de294db5dc7ee095adc2faa568ae4ee55e6e8db9a0e945f73f9a320a4d30ebda57bd291859a46111d836a7c0bcd4498ed8e8d19f8b7e7fa378117de9c
- SSDEEP
  
  196608:+LDna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:MDnaOyRQETSBvJSOq62YHtFHN
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (131) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Targets

Renames multiple (131) files with added filename extension

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2