darkside

General

Target

om6osj7p9.exe
Size

10.1MB
Sample

230804-weyz4add38
MD5

60e4584ef6e476cb4913ff10b4407163
SHA1

18e657cf23af9c0cddb91f87375d4e67ac5f972d
SHA256

62af63c631b2f5a4d25ede64b783a0059d7b81aa17af33fb9bac7c758c91b46e
SHA512

ebe6189915dc76d9ed2c0640d37c8f8f237fd3a9277b54a6d5ada9ab0013e89674872270203e49fb735334f5763d380bf78a9ef709892e21aa8055188b121185
SSDEEP

196608:f3Dna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:vDnaOyRQETSBvJSOq62YHtFHN

Score

10^/10

Malware Config

Extracted

Path

C:\Users\README.8d5bc3f1.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide - I-D Foods Corporation] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW When you open our website, put the following data in the input form: Key: 9NtjyWHbqWYTbhBpJ2ht4tKo7DQgTGmQ4IGHCFvgjiSMTNopVgQ9YIh9KRWkQgmvxviZtJGOakzykMzWKRgxwf2pCxpdMT8iGlKcsSOsxVOUXIGEgpy6tLqliTTEKWnohcYOhCF3DYMePMxEYa0eCmED1EXEG5QOZCpmkgDl5s5VSUF5uhnKsunUtKGS24iEAr2hxsJ1zMcMHmKVrf3bvRyhYVKXwlXVggxE7ncowldcK3v3CiKC24jKVd6OH5QrhVyyQLrFM5RE3Y0RcTeRTIqf1J5CIEhTiG3TH7SEpws4wfkt9RZ7rBWT4n3B69Z9JuPzyFCBwPKF7gTzEYzixIGzFbJyLSZXff9ryv3yL3JeKywAcoBafos0dLSkRgf1X1a1S2ud4kXa5GRU4W7rhCQsnJ8vAcv1AXaPRq9ESySBWQdGCQMSci0ex0oE4EfCDW3jjyXtaPofqNFhibodJFmOyTKwie1OcW6Kh6Ih6JxXXfUXr4VbRILzsiPXsOTTisDaEicID1E0SJRluBus2UhPyogJiZ7UpmUu9LUe3yAi3Bhox3pLv8E !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW

Targets

- Target
  
  om6osj7p9.exe
- Size
  
  10.1MB
- MD5
  
  60e4584ef6e476cb4913ff10b4407163
- SHA1
  
  18e657cf23af9c0cddb91f87375d4e67ac5f972d
- SHA256
  
  62af63c631b2f5a4d25ede64b783a0059d7b81aa17af33fb9bac7c758c91b46e
- SHA512
  
  ebe6189915dc76d9ed2c0640d37c8f8f237fd3a9277b54a6d5ada9ab0013e89674872270203e49fb735334f5763d380bf78a9ef709892e21aa8055188b121185
- SSDEEP
  
  196608:f3Dna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:vDnaOyRQETSBvJSOq62YHtFHN
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (157) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1