darkside

General

Target

485b9fd90d99ec5e6683fa4448924da8_darkside_JC.exe
Size

58KB
Sample

230819-svvqtsbb85
MD5

485b9fd90d99ec5e6683fa4448924da8
SHA1

744d07feeaa7cb10b11d5ec72418bd1ecbbba819
SHA256

93cb3d33780673999559924e7df3f1d930ab9eda4ce61f8c6fed80547c8b7234
SHA512

3734e195e9a9a73a5ae0b8daa88b62303da69a2734312448cf26d469c2a811e0ebe4bfd0b90f56e6bf1998d1b4baccece7811bcb78bec1f196819e289f45a0b6
SSDEEP

768:ZjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvMpY23W58:Cx7Fu4/ihrhDTV1ylvMSZ58

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\README.3f8e9045.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT When you open our website, put the following data in the input form: Key: 0kZdK3HQhsAkUtvRl41QkOdpJvzcWnCrBjjgg5U4zfuWeTnZR5Ssjd3QLHpmbjxjo7uWzKbt8qPVuYN38TsDPI3bemd5I40ksemIzuI5OhIHZsi9cn3Wpd7OUT72FP9MyAUzR586yMsI2Ygri9in0Bf4EkG0pmBOLyRG1T788foGJQW1WxS1Qd2sMVvX0jKlbGG1zLp7g0u6buDCzSMyTjWjuVzJYufBBv7S2XvciEVvboiTNbZA4UUU6PttKERQSb018aILd6xO3ulk6fbEgZDO5tZSGn2zRevn5YXnHtg6vt1ToLe3izQOgYbs8Ja1fkfJBUYVux1ITyWBjpn0xPayKfwln8SqgMkbqiDyxEDEtFhqiffLcONMhi4TmW50loZIC6mWSaOjThWp6XSJUWPtY8Mkzs8Cs0qjPahx58iAEVIRGUVpLkMs7xPN7ydZ6wMWaOcRC1AD1JEUVTjLikXXyckgYaS6FnEv0UNEsv6QbTLSpDomIg3rEYZBib6ozrwH5n0M5wrKo8NciUBmfJWDP4XKkjznpsa05rEpuAklM0dMmZsYGVR !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT

Targets

- Target
  
  485b9fd90d99ec5e6683fa4448924da8_darkside_JC.exe
- Size
  
  58KB
- MD5
  
  485b9fd90d99ec5e6683fa4448924da8
- SHA1
  
  744d07feeaa7cb10b11d5ec72418bd1ecbbba819
- SHA256
  
  93cb3d33780673999559924e7df3f1d930ab9eda4ce61f8c6fed80547c8b7234
- SHA512
  
  3734e195e9a9a73a5ae0b8daa88b62303da69a2734312448cf26d469c2a811e0ebe4bfd0b90f56e6bf1998d1b4baccece7811bcb78bec1f196819e289f45a0b6
- SSDEEP
  
  768:ZjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvMpY23W58:Cx7Fu4/ihrhDTV1ylvMSZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (149) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Renames multiple (183) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2