Extracted

Extracted

• • Target

    NEAS.2023-09-08_88ca5f2b3e4f927a229d341dc604bd54_darkside_JC.exe

  • Size

    148KB

  • MD5

    88ca5f2b3e4f927a229d341dc604bd54

  • SHA1

    ac23b8d5ec5b795298b228984b406741d1d11b96

  • SHA256

    2c7e0ce7343edf97cf8ce2a5cff6a0c0d981ddb73f29dae9664ddfccdc7fdafd

  • SHA512

    9694d5f34253203cb8a460c29d28762230e78696ee55e612e9b38fe9a3e5ef994c513033485e770c00c33870ee0894a8fbc735d8c33f1b8c80ed7e95aa0f6ff7

  • SSDEEP

    1536:tzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDMVzX3Z5iU777LquNfWV6THFHGK:+qJogYkcSNm9V7DMVL577fWg7FHGKTT

  Score

  10^/10

  ransomwarespywarestealer

  • Renames multiple (354) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Renames multiple (554) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2