Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    06cfe7f5d88e82f7adda6d8333ca8b302debb22904c68a942188be5730e9b3c8

  • Size

    59KB

  • MD5

    91e2807955c5004f13006ff795cb803c

  • SHA1

    a3e7561de73378b453186a6c33858bf47577d69c

  • SHA256

    06cfe7f5d88e82f7adda6d8333ca8b302debb22904c68a942188be5730e9b3c8

  • SHA512

    5d98bc32af83462938633c0d2b692d5b69c9c6151459aefc1276d41947e2514c444ed417c19b39b9c5b8d5359dee5fa2d3f7c8c30ae9f2a687cd02ec3a7b6311

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yln/pY23W58:0x7Fu4/ihrhDTV1yl/SZ58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (148) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2

• • Target

    0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d

  • Size

    59KB

  • MD5

    885fc8fb590b899c1db7b42fe83dddc3

  • SHA1

    c104056f9a926d27a2082f0510c97b09cb0eb3e5

  • SHA256

    0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d

  • SHA512

    2b8e49ad84434dcaf98635120ac54bfa7e55bb61bf9d0e3f1f25ab81e950f638311d2121217bf5840834778d5e137551e24b89da02f12dc6be99d755c54f4c13

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3XsY23W58:0x7Fu4/ihrhDTV1ylHXZ58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (178) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3behavioral4

• • Target

    12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975

  • Size

    59KB

  • MD5

    c830512579b0e08f40bc1791fc10c582

  • SHA1

    2fc8514367d4799d90311b1b1f277b3fca5ca731

  • SHA256

    12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975

  • SHA512

    b8e7dc2b26ff00c43dae3e5ceb2b241bc7211c52fba167f1dfd81b285461fd53668953ede798a5f4fd1c587ee9861c2ca0fd034a958428dd3d9f5177c61b5ca3

  • SSDEEP

    768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1ylBpoT6Y23W5o:BpDtG4nMpboDTV1ylXsZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (157) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral5behavioral6

• • Target

    151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5

  • Size

    59KB

  • MD5

    9d418ecc0f3bf45029263b0944236884

  • SHA1

    eeb28144f39b275ee1ec008859e80f215710dc57

  • SHA256

    151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5

  • SHA512

    82ced42a32f18ede4358459e08bed1adff85d49c952aca7a086571c5b71fd8b3185ea4306abd1f4e639a12f11161f43c73bf6049d76902d365c5a5e4c7e71f3d

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvD7Y23W58:0x7Fu4/ihrhDTV1ylbcZ58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (155) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7behavioral8

• • Target

    1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43

  • Size

    40KB

  • MD5

    1a700f845849e573ab3148daef1a3b0b

  • SHA1

    c91ff86a88038b00d9190ebb01e6f8c94b0c83e0

  • SHA256

    1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43

  • SHA512

    d7fcf0ef26bbe1d6104c098711ccdfd33655e62045f6975dd3c48ab34888c83b771dfd07682004943bab86b2dbcb7905364becead09c37de3da0b28e8265dc81

  • SSDEEP

    384:woyzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpIN:wo4EpThIpEdauX3hS/sj5kGudUj9Vg

  Score

  3^/10
  behavioral10behavioral9

• • Target

    17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61

  • Size

    59KB

  • MD5

    cfcfb68901ffe513e9f0d76b17d02f96

  • SHA1

    766b30e5a37d1bc8d8fe5c7cacc314504a44ac1f

  • SHA256

    17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61

  • SHA512

    0d26fa9478f4626107e38c570d1bae1049b744181cf0395d95fb07675575ca393d88d4783bf31bdf11bef1da5648a5a53a6d95b21492f96b4de35c0ec323ae0c

  • SSDEEP

    768:9jjV7Iax7F3DS4/S96/P3rsAc4ci5pwwX5+R4VYY23W5:vx7Fu4/i6/P3rlckx5+R4VDZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (189) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral11behavioral12

• • Target

    1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb

  • Size

    59KB

  • MD5

    6a7fdab1c7f6c5a5482749be5c4bf1a4

  • SHA1

    4e6d303d96621769b491777209c237b4061e3285

  • SHA256

    1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb

  • SHA512

    39446ebfae1dd0e007e81087f42021b95ee5a0a04e22ca7f4f5addbea4e71c7fe09ffd3bf953400955ce6d31b535c81a37b018aba73c30e61575b2c49414d6cd

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvMpY23W58:0x7Fu4/ihrhDTV1ylvMSZ58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (154) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral13behavioral14

• • Target

    243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60

  • Size

    59KB

  • MD5

    0ed51a595631e9b4d60896ab5573332f

  • SHA1

    7ae73b5e1622049380c9b615ce3b7f636665584b

  • SHA256

    243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60

  • SHA512

    9bfd6318b120c05d9a42a456511efc59f2be5ad451baa6d19d5de776e2ff74dbee444c85478ee7cfdbf705517cc147cd64c6814965f76c740fe1924594a37cb5

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3RYY23W58:0x7Fu4/ihrhDTV1ylhZ58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (170) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral15behavioral16

• • Target

    27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f

  • Size

    59KB

  • MD5

    3fd9b0117a0e79191859630148dcdc6d

  • SHA1

    cf04fa736baf22a2ca4e67f1c7723f1776267e28

  • SHA256

    27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f

  • SHA512

    c5175720f432c157eb34da92b29a15f1d7cee77240be12289d5cdb52419dd448b2081a579f783fd48d6226d49057eb3e79f38d85d335761089386a621d1419de

  • SSDEEP

    768:vjjmbIax7F3DS4/S9NbnASghx2/ZGNePXPz+3+sT9BmXkY23W58:0x7Fu4/iNbASw2xGNaXrtsp2/Z58

  Score

  10^/10

  ransomwarespywarestealerdarkside

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (187) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral17behavioral18

• • Target

    3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6

  • Size

    59KB

  • MD5

    c4f1a1b73e4af0fbb63af8ee89a5a7fe

  • SHA1

    5604a48ce74124fb478049976db48197896b6743

  • SHA256

    3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6

  • SHA512

    67e6b184b926b1de2fa1d4c429db33b4b4146a0c5eb6929422d6ec161654fc634dce7810a1deb0befdf7d932df1edfc02251d8193272c1d1c713a1df8da32ceb

  • SSDEEP

    768:Dbj5aI1NaUzt023Zexasb1w/WF4BtCCuSbVQdNcxGV1ylqdwB:FNaUzt02pSaq1wT4rxDTV1ylqdwB

  Score

  3^/10
  behavioral19behavioral20

• • Target

    43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa

  • Size

    59KB

  • MD5

    f9fc1a1a95d5723c140c2a8effc93722

  • SHA1

    ce2480dec2ee0a47549fad355c3cf154f9aab836

  • SHA256

    43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa

  • SHA512

    3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11

  • SSDEEP

    768:9jjV7Iax7F3DS4/S9F+YeYf+tB1tJq5c2yGHMwY23W5:vx7Fu4/iF5eTtJq1sLZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (160) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral21behavioral22

• • Target

    48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a

  • Size

    226KB

  • MD5

    c81dae5c67fb72a2c2f24b178aea50b7

  • SHA1

    4bd6437cd1dc77097a7951466531674f80c866c6

  • SHA256

    48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a

  • SHA512

    30d63e080f37f34fb29fd46f8fb1572d79f645154a002c8da5914ae3d51e224bc60601f91f5d58ac2ce9f81d56a8ad467d7fde55d429ed269df3c196e6687b2c

  • SSDEEP

    6144:UQyTTOip6TGcWnsmx7KbYrBPIJqcKxxY1:E3gGcWnNJIJqDxxY

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (136) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral23behavioral24

• • Target

    508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add

  • Size

    59KB

  • MD5

    69ec3d1368adbe75f3766fc88bc64afc

  • SHA1

    11936a92144ef1b53eef16566a57b9052d173291

  • SHA256

    508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add

  • SHA512

    58f0f04cb05221e9a50eab89924c45bccc15045e9552e10f39ebbb651eddc5d4fafd95a1ba80f4a6ab8d23c4d3dfff7669e2499650b328420c766cae82e439e8

  • SSDEEP

    768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1ylQ+IxGY23W5o:BpDtG4nMpboDTV1ylnIfZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (185) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral25behavioral26

• • Target

    516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b

  • Size

    56KB

  • MD5

    84c1567969b86089cc33dccf41562bcd

  • SHA1

    53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2

  • SHA256

    516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b

  • SHA512

    72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa

  • SSDEEP

    768:AiN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy81XweyetnR9Wsf5AyT9G3kZ:r4HHerjZX7pLken5nWXWi

  Score

  10^/10

  darksideransomware

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (136) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral27behavioral28

• • Target

    533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d

  • Size

    59KB

  • MD5

    0e178c4808213ce50c2540468ce409d3

  • SHA1

    38b5aa765026dffbb603e323333294b5f5efa5ee

  • SHA256

    533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d

  • SHA512

    262a8f4808f6c3499c9eb465b480508ed6b082ddd36cf2e618a9455b5abbc2eb6a8d7b7c2f398faaa62ffb22599a8b2eec0d3137fdec648de37ac4a73e6f44f4

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylgoVHuY23W58:0x7Fu4/ihrhDTV1yljH5Z58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (146) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral29behavioral30

• • Target

    6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff

  • Size

    59KB

  • MD5

    5ff75d33080bb97a8e6b54875c221777

  • SHA1

    810d6c70a96584486867cedde111a1087ed1ebe7

  • SHA256

    6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff

  • SHA512

    a6b87ddcaa797a4d8abc06a786a7186fe43eef5e3291402f81b95a180b7fb746f88cd0f408a089deb5321ecf0d2ac3cca479fdc1f782771749df0ac5a082ac00

  • SSDEEP

    768:9jjV7Iax7F3DS4/S9QCuUSbVtdNcxGV1ylMRY23W5:vx7Fu4/irrUDTV1ylMqZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral31behavioral32