darkside

General

Target

E4G24DU1GQR.exe
Size

10.1MB
Sample

230804-wdcqgadc89
MD5

274ac4d59e5bf71927f1013b270c7eab
SHA1

b5a568e19c3cf5b7e26673d5eb3c77bd146a2ecb
SHA256

97646796eab26c2005511c2939821bbdc624afb4704450ba3b2ef91b122c01a5
SHA512

e7247d76a447ff8f524c572f6006fcb04af5c9bb8b51db3d969971000050d67efbba34e596a11467b76a0b5f850709ad941c3e6cd79b61e7dc4ce395bcc5bba0
SSDEEP

196608:/NDna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:lDnaOyRQETSBvJSOq62YHtFHN

Score

10^/10

Malware Config

Extracted

Path

C:\Users\README.6d39d91a.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide - I-D Foods Corporation] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW When you open our website, put the following data in the input form: Key: 9NtjyWHbqWYTbhBpJ2ht4tKo7DQgTGmQ4IGHCFvgjiSMTNopVgQ9YIh9KRWkQgmvxviZtJGOakzykMzWKRgxwf2pCxpdMT8iGlKcsSOsxVOUXIGEgpy6tLqliTTEKWnohcYOhCF3DYMePMxEYa0eCmED1EXEG5QOZCpmkgDl5s5VSUF5uhnKsunUtKGS24iEAr2hxsJ1zMcMHmKVrf3bvRyhYVKXwlXVggxE7ncowldcK3v3CiKC24jKVd6OH5QrhVyyQLrFM5RE3Y0RcTeRTIqf1J5CIEhTiG3TH7SEpws4wfkt9RZ7rBWT4n3B69Z9JuPzyFCBwPKF7gTzEYzixIGzFbJyLSZXff9ryv3yL3JeKywAcoBafos0dLSkRgf1X1a1S2ud4kXa5GRU4W7rhCQsnJ8vAcv1AXaPRq9ESySBWQdGCQMSci0ex0oE4EfCDW3jjyXtaPofqNFhibodJFmOyTKwie1OcW6Kh6Ih6JxXXfUXr4VbRILzsiPXsOTTisDaEicID1E0SJRluBus2UhPyogJiZ7UpmUu9LUe3yAi3Bhox3pLv8E !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW

Targets

- Target
  
  E4G24DU1GQR.exe
- Size
  
  10.1MB
- MD5
  
  274ac4d59e5bf71927f1013b270c7eab
- SHA1
  
  b5a568e19c3cf5b7e26673d5eb3c77bd146a2ecb
- SHA256
  
  97646796eab26c2005511c2939821bbdc624afb4704450ba3b2ef91b122c01a5
- SHA512
  
  e7247d76a447ff8f524c572f6006fcb04af5c9bb8b51db3d969971000050d67efbba34e596a11467b76a0b5f850709ad941c3e6cd79b61e7dc4ce395bcc5bba0
- SSDEEP
  
  196608:/NDna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:lDnaOyRQETSBvJSOq62YHtFHN
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (158) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2