darkside

General

Target

rrny39xaraapr0uc.exe
Size

10.1MB
Sample

230804-whv3lsef5w
MD5

06ab5efce87a3a5a0bd0017d2d641589
SHA1

6bbf9f00b9e0f923f5579a18ae1b4bd4b5629a32
SHA256

2dfa8ae31c3f6ffd0b35f94501ce8b7ca2251642e7473e5a01b537c0ccf9aa53
SHA512

52f7519906d246303416b52c221d788aeb20ce7a4803283ccf5d23af744b0f00fc1c80e5e3a4b7bc549021b49af9b111eea1a3d73ca28817ba7273711febed8a
SSDEEP

196608:ZmDna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:8DnaOyRQETSBvJSOq62YHtFHN

Score

10^/10

Malware Config

Extracted

Path

C:\Users\README.c6d30de8.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide - I-D Foods Corporation] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW When you open our website, put the following data in the input form: Key: 9NtjyWHbqWYTbhBpJ2ht4tKo7DQgTGmQ4IGHCFvgjiSMTNopVgQ9YIh9KRWkQgmvxviZtJGOakzykMzWKRgxwf2pCxpdMT8iGlKcsSOsxVOUXIGEgpy6tLqliTTEKWnohcYOhCF3DYMePMxEYa0eCmED1EXEG5QOZCpmkgDl5s5VSUF5uhnKsunUtKGS24iEAr2hxsJ1zMcMHmKVrf3bvRyhYVKXwlXVggxE7ncowldcK3v3CiKC24jKVd6OH5QrhVyyQLrFM5RE3Y0RcTeRTIqf1J5CIEhTiG3TH7SEpws4wfkt9RZ7rBWT4n3B69Z9JuPzyFCBwPKF7gTzEYzixIGzFbJyLSZXff9ryv3yL3JeKywAcoBafos0dLSkRgf1X1a1S2ud4kXa5GRU4W7rhCQsnJ8vAcv1AXaPRq9ESySBWQdGCQMSci0ex0oE4EfCDW3jjyXtaPofqNFhibodJFmOyTKwie1OcW6Kh6Ih6JxXXfUXr4VbRILzsiPXsOTTisDaEicID1E0SJRluBus2UhPyogJiZ7UpmUu9LUe3yAi3Bhox3pLv8E !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW

Targets

- Target
  
  rrny39xaraapr0uc.exe
- Size
  
  10.1MB
- MD5
  
  06ab5efce87a3a5a0bd0017d2d641589
- SHA1
  
  6bbf9f00b9e0f923f5579a18ae1b4bd4b5629a32
- SHA256
  
  2dfa8ae31c3f6ffd0b35f94501ce8b7ca2251642e7473e5a01b537c0ccf9aa53
- SHA512
  
  52f7519906d246303416b52c221d788aeb20ce7a4803283ccf5d23af744b0f00fc1c80e5e3a4b7bc549021b49af9b111eea1a3d73ca28817ba7273711febed8a
- SSDEEP
  
  196608:ZmDna+butR4FMIZETSt3jPePdrQJ2BNOq62gAqYPYgUFHN:8DnaOyRQETSBvJSOq62YHtFHN
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (176) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1