darkside

General

Target

cd2fb1d044d414dcbf32bf67f2563208
Size

2.3MB
Sample

231220-r7aezsffdr
MD5

cd2fb1d044d414dcbf32bf67f2563208
SHA1

98dae9d51bc1ee7d619a546550adc2e98113db17
SHA256

f6ef88d4e7d9db6085e1d64762cc01fc64bfd9cc632f228e84bd5f5038030589
SHA512

88a89c729f4edf3cb944de03bed2177cb9b2791de261bbdb15ebeceb075311ba9318abedfa8380a194062b048496f43c9a5bbfdf712f96a69aa4b5d80c1adbde
SSDEEP

49152:kloF0g3n0xTxvO0REE0zVeWbKr9P95upyQQoQxlyxBf9NGFzdCh:kloeO0e35NKpPrqyLo4ah9+Mh

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\README.398da5ec.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, private data was downloaded. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 300GB data. Your personal leak page (TOR LINK): http://darksidedxcftmqa.onion/homehardware/K4fLrrmO5GOIBHbhfJyN5rG4pkPcRlnc48ceUHtNgjONruPRTVc4Usyb96BuHkKa On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published in our blog if you do not pay. After publication, your data can be downloaded by anyone, it stored on our tor CDN and will be available for at least 6 months. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. HOW TO CONTACT US? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/FJ6BL608YXVN8DGFDP23JVF2RU0K0IC102LSJA09Z2JF14A1SCCJBOVPLRHSLU16 When you open our website, put the following data in the input form: Key: FSGLQojvXe6Tvm2w0wxP3QfWkJb1USBnFsbmL4CiIX0sBiV727ofcmrdJmUTgBStIrH7sgcBDo4SPki6BniKhpd7d4zjLSAxmtlwLAHLgtBnwYPuW05gxF4VPuXsylwu2p3k6ZWDTjCIZVVG04RCYEfS3AP25AWqGkFDh4KVy7MZsCVH7RwxEdhWyApxi7Ioai3v52ofbfNgys0V0sG2xWqJgtluhQ4J23O7jCZxqMM10civs8NlDmeJAiIkI43RrPDd3P2kA03ky3oUBNeUPOOnAztZQezpfAgiM8evd3HE9aua1yUEX4hndxmFU02CEYIiyah3g5ywISASKAeiXKCJoThOot42MHwMCl0G7wP6KdHVyPx8uhBdT2kbzvjGZvmOibfxKUlxJlhai4DhjDp9mUuJajTrBYoeogvOzrgc8iv0PcrAABLRGU2I9uSFIlFqZeuIp7qMW7DIZKrunidyvfL1oTtuosI8bQ0BVvooDC1BB5n5Biw9x2yBNit4lOjMhY00P3wTLvMhS3ZQ6eGKDmx7GrQ7ydGo6I2A0eQx9dpuxhWpkpc !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/homehardware/K4fLrrmO5GOIBHbhfJyN5rG4pkPcRlnc48ceUHtNgjONruPRTVc4Usyb96BuHkKa

http://darksidfqzcuhtk2.onion/FJ6BL608YXVN8DGFDP23JVF2RU0K0IC102LSJA09Z2JF14A1SCCJBOVPLRHSLU16

Targets

- Target
  
  cd2fb1d044d414dcbf32bf67f2563208
- Size
  
  2.3MB
- MD5
  
  cd2fb1d044d414dcbf32bf67f2563208
- SHA1
  
  98dae9d51bc1ee7d619a546550adc2e98113db17
- SHA256
  
  f6ef88d4e7d9db6085e1d64762cc01fc64bfd9cc632f228e84bd5f5038030589
- SHA512
  
  88a89c729f4edf3cb944de03bed2177cb9b2791de261bbdb15ebeceb075311ba9318abedfa8380a194062b048496f43c9a5bbfdf712f96a69aa4b5d80c1adbde
- SSDEEP
  
  49152:kloF0g3n0xTxvO0REE0zVeWbKr9P95upyQQoQxlyxBf9NGFzdCh:kloeO0e35NKpPrqyLo4ah9+Mh
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (155) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Renames multiple (155) files with added filename extension

Drops startup file

Reads user/profile data of web browsers

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2