darkside

Resubmissions

27-01-2024 19:37

240127-yb5pksafd3 10

27-01-2024 19:36

240127-ybqwesafc2 10

12-05-2021 15:56

210512-db4t7vmwas 10

Sharing

Copy URL

Twitter E-mail

General

Target

5196509513285632.zip
Size

15.6MB
Sample

240127-yb5pksafd3
MD5

a9f3fe11971ef3a634767f345ff8db86
SHA1

3895b734e6de23ee5e3fdcdc35b2df5ae5223ec6
SHA256

0f808fd3ecf9d722aafeee46b57aad4d07f39c98be6f6148be979ed470cf0a99
SHA512

1268b1ab9c9891a4e6d20f17fdc61c2c85971ad2efb6e8d00f7a0cdb59613a2f9c1ec4c72bddab03c8e7c62f07d694860808928edb4a8ced41438f2b4c2a9edf
SSDEEP

393216:Y+ITF20rAgtw8FFy0nMlTKo6pa9JzyzbzS3klSYi:Yzo0rAR8FFyVb6MLLklSYi

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\README.f04e4642.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data Leak ---------------------------------------------- Dear Isolved, pay close attention to this message because it is very important. When penetrating your network, there was a global data leak from your servers. More 350Gb of DATA. Except that your network was fully encrypted. We have all the most important data from all your servers: Bases, E-mails, Accounting, Finance. If you do not get in touch within 72 hours, information about this incident will be posted on our blog, which is monitored by leading media in the U.S. and the world. Blog URL ---------------------------------------------- http://darksidedxcftmqa.onion/isolved/OLVrV9bQny0XcUSkk8y6cvFWox_2cRFUiz95xG-hYGKETYuH1rlnl2d5exhQ0jHu What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/AZHT20L23HCABE7V5FLPMR50Y0LPCNWKLICOH3MP156YR8DTFJGUE935ZG0QYCT6 When you open our website, put the following data in the input form: Key: MDwY2fJ0wMOMksG1GCvkBclFQNBOoNOtoKM1UfDyDwuobpBZwC5VSc9Y3cd130WLEVnipGp6jBFSvhWyVQsa0J0ICcDu9ihtUQ5yYCtSPNWu0XNtNwXchonPQ0iMpRO0leoAYPOeLNbBNkz7xlWPAOBMSBKpVQn1if08n0xBOpY7xC8J9BFmbbkZutVMbLqVqGzF8Q31iGOIDpONYRDC6KQ1fZMZhHIiGXStZG8NtnZYvQQ94XKRhCuhWNfNh1SmyM0YPNMVAnslDpZLmveZmB1vNxinwAlMJj67lVkjwXQRdcRiemxRpX7gIx6zbuvkqtdYIBo1q3neaVNLyLxogP8b50tKxc0Uok1lxDfTsZ61wmNhbJiyh1FXvjgZGrvEuR2SGm5to0K6fIA8GIA8Viu2AhxUOafNcYSKXckS5hq0zYOXnITkTJFvStKKSOLzp39sYyPYmDkyIPPQUTGsoqCIti0Sb2BQFTGkQQeqvnhdTJZfzVKGobFXx0b2aWi1yYavjfLdOdVzVQJIVyeOYe610BOT4L4fRpO38eiAcwKuS1eRwskD2jP !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/isolved/OLVrV9bQny0XcUSkk8y6cvFWox_2cRFUiz95xG-hYGKETYuH1rlnl2d5exhQ0jHu

http://darksidfqzcuhtk2.onion/AZHT20L23HCABE7V5FLPMR50Y0LPCNWKLICOH3MP156YR8DTFJGUE935ZG0QYCT6

Extracted

Path

C:\Users\Admin\README.c05ced76.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 90 GB data. These files include: Finance data Insurance data Buchgalting Data Banking data and details, bank contracts, creditors info Much personal data Marketing data Production, Technik data Email conversations dump and more others. All documents are fresh (last 365 days) and stored on our offline servers. All data will be published piece by piece. First data pack will be published in 7 days if we do not come for agreement. Your personal leak page: http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF On the page you will find examples of files that have been stolen. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH When you open our website, put the following data in the input form: Key: rIzr2nCuqbQL7MGMwoppaucqSp5AZufUiYhssYa1SGfO0XFf09fBDlLDWgKQSnnvIAfqYTsOgUhOTxzbxGsC9nH0yk2HOFhn7t8ntX8L0evyce8vKdgUKF7Xvjn6ljaQQ4HPEfPZFP2jvN0DgBVWl2WgNT1U3owZ1bNBjps34t33ObZc01Ce1yKx5CSlwUYbw1ktjqt5d7R9DwRL3NIGrTHvMX3qXI5aBAUnirnc4zHtfGPXq4CuFoh04Tv7VE81aohfvuz8D7wo7i28sbILoJyF6mzeQwSkAXolOhXKQAEPsGcdbfLxfY5uILkHB3d1gAyxT1owQXsY4heNQbY3yYL1Em7dDaLdbNhOf0adYWFiFfAl9EwLDRT96L9Xzsk17ho1B82wOWZ79ZqtT8yqnZ4APJb1LO91ASSsgUdNvR0lAaZTfXHHxUI1vDm5ygyV7cbxMlrQ5K1U6ughdd5WosogMJWVNjreirhzuDzY6SnixtukGYG0D9azzgOHcgidJcLV4n0orhzIaA1SMNYOpdOIadgBehCaHwEyr3hn8CEa6fgpUgK6E95 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF

http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH

Extracted

Path

C:\Users\Admin\README.47246f95.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT

Extracted

Path

C:\Users\Admin\README.3b86d701.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide - I-D Foods Corporation] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW When you open our website, put the following data in the input form: Key: 9NtjyWHbqWYTbhBpJ2ht4tKo7DQgTGmQ4IGHCFvgjiSMTNopVgQ9YIh9KRWkQgmvxviZtJGOakzykMzWKRgxwf2pCxpdMT8iGlKcsSOsxVOUXIGEgpy6tLqliTTEKWnohcYOhCF3DYMePMxEYa0eCmED1EXEG5QOZCpmkgDl5s5VSUF5uhnKsunUtKGS24iEAr2hxsJ1zMcMHmKVrf3bvRyhYVKXwlXVggxE7ncowldcK3v3CiKC24jKVd6OH5QrhVyyQLrFM5RE3Y0RcTeRTIqf1J5CIEhTiG3TH7SEpws4wfkt9RZ7rBWT4n3B69Z9JuPzyFCBwPKF7gTzEYzixIGzFbJyLSZXff9ryv3yL3JeKywAcoBafos0dLSkRgf1X1a1S2ud4kXa5GRU4W7rhCQsnJ8vAcv1AXaPRq9ESySBWQdGCQMSci0ex0oE4EfCDW3jjyXtaPofqNFhibodJFmOyTKwie1OcW6Kh6Ih6JxXXfUXr4VbRILzsiPXsOTTisDaEicID1E0SJRluBus2UhPyogJiZ7UpmUu9LUe3yAi3Bhox3pLv8E !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/LYID3U99RAJSTEYEFWS6SLYDGMUXKNAT3OPKN9D56PIGX1QHBU5DHGUN4HGMX2IW

Extracted

Path

C:\Users\README.bf7a98bf.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 37GB data. These files include: - Office - HR - Tax Confidental - Finance Your personal leak page: http://darksidedxcftmqa.onion/blog/article/id/62/HaER8VXDfRbMaspeLi3Za1LoRutpsd_nKm-yHc5RAJk1xxMFe2jnOQlD70US6XCT On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/SN8W532EY9MVOD09H4HBVZ1RI9RS4AATPO11NCDX0JKZ7GAPU6K6CV3CVLSS2NMH When you open our website, put the following data in the input form: Key: XMBN2NXBcASwNZe2y0u6Ty85zTQbIDUSEUQC05GXqrgGHcKS32we7VMDJPqr1uhgc15HqzScoT9CtNH8J0C8gU83Y14hWndBD65NxvnEpPJVdxcX840aQs2l0JH4Y3gaGTkLfYt1TQLKbgPAmS3nXg3eJapHm7ccbb2ggSgSDnik8nt6KP2Ol3STOpHdWA4eBw1W47PJYZZptMLgthDW098Dlf73wTCaHi0fmedIcHVcoE8SpYYACKiyApeWQqHkWLketZrGTd3k0hTVkCJ16nUoiNkpLMAxAxEAnPTWydYFabnk7jz6cJBrxjOA4HAQCaKIqr5AzL5ArFROpXxuT5Zn71BiDnCwQGCmZO5PG6OJITvblzcS9eWvVPUWsDqVWkNXqco2ulxf0oefiPyt8oOcXcdOZQdEh0TvOdXzh7tRS0nYWcAkQLTdqz5JQEJetzsQPvnokvKb2Jk58Dbl9pesPTw3K4unS5GHOifTDRxvO2Al1VM4TgPUzRZKLQusXzSTRvFOW1JJ1sO9Ixl7HnozD51emn3ekYSE0WdSyQr2p7Dlrr97TMt !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/blog/article/id/62/HaER8VXDfRbMaspeLi3Za1LoRutpsd_nKm-yHc5RAJk1xxMFe2jnOQlD70US6XCT

http://darksidfqzcuhtk2.onion/SN8W532EY9MVOD09H4HBVZ1RI9RS4AATPO11NCDX0JKZ7GAPU6K6CV3CVLSS2NMH

Extracted

Path

C:\Users\Admin\README.47246f95.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/DZYNTXY9RP5P8DQ96EFKV2YTOVAMA3VVHL5V0RASUBLBWZGLG51U4LOOBSHV9R0Y

Extracted

Path

C:\Users\README.5136c709.TXT

Family

darkside

Ransom Note

----------- [ Welcome to Dark ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 100 GB data. Example of data: - Accounting data - Executive data - Sales data - Customer Support data - Marketing data - Quality data - And more other... Your personal leak page: http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68 When you open our website, put the following data in the input form: Key: pr9gzRnMz6qEwr6ovMT0cbjd9yT56NctfQZGIiVVLgo0ME2EQpAUyZucG9BLrOJjno5XLPvCN11TFfnlFHa42u5mJxoeR5k5RUgQAC1MC6LBUj4YOOAUyiBrR HQSUM3pzGoEPRVOzXSZ8YqkJyFL0TDFBbWaBKQDOSo9GzKKoVRQ0Eb02F5geTPkTAqZZSfSQ6PBBlTGPSgGe2kCyuwwp7lDmRSJlNnHssMMZHVhXzyZ6fxiBY gNiuusFK8JNI5nrtRPp3bMAc6OEddxfJWj6o2GT1Xg9j87Jp4Oyv43E1J61jLJAWBkmoBB3Gqv07mtyDW5PnmxBlNzABbLFEvJMQL23sR8nnw4svzcZHxrqD1 xRcxqyeKtsaQ5yqLvyQgMdnrI2QoCqkHYYUfBIzjO8BXyBZdmjHanXE57jdDAhjaDUUqfL917cCyJr1uwVR0Xj5lJXe8BIKHd3dFrz70CsIXFAhicOsBlFzIn daNcAXXyL8Fg1avIXOcuEkGRDXt8Cs8b3TAB6n4DrbLJdiFjECo8yCA9pxvzqjXatumUloblWFZaUoLVYzP !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC

http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68

Extracted

Path

C:\Users\Admin\README.f04e4642.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3

Extracted

Path

C:\README.5876a5f0.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 500GB data. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I When you open our website, put the following data in the input form: Key: I3tBdXvJ3pOvnhgmupZAJ7BpD5IVUftr7deEdtoxwK0QcbZciUXfs5ChjD0Yj8H2wUXfctFHYShVQHWhwi1CBDRQVPgXqnCgVRQql7B1tS8Q6TSdHq5o0UxOaDrdKCoMCdrMZiw0RTbfpDpuRwLI52rP5YaqZx492wErocN9C7PE6eFQEcqwqiFNA1FwVD3fogTJqOdTJI84FnlCBuRd1ippdTk8y2x16ukfPvVHi4MhyU8i4K1Q25a7wXQUPXhIffgZBnTimLzalSGyaI3f2MlQeYbpFG2o4nfnZCHDMAZAUY6CaiR0eAYVEvesreMmimT1EOyGYjNVtGHrJYXuRI4tYZIVlsHm6Ord42NV9s9PftLGkO8NBScZ9dBTNtz0xw9tpgu8GegVTlMesg6xkUAQWJcy6MNt9nJ7lHydpu27bA1GL8MX8lWAldnClSoUrDYRc8RAZ1oUfMfbtmvMDBGVENh8kMUYaxOt7hD1HxKFn0p5XcCDzWRSWkKUTtt7C6OiIpNOUAYYJ3UvC5S3uoXmt4iokkGq1SSMnr7sXmnekmh9oNwJgh7 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I

Extracted

Path

C:\Users\Admin\README.3b86d701.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/VGBU8VAXXW7EYB5U4KQJXUGU5NT5FP8208W6UXVSKQDAE3CNBR4JTZQCXEZFZWF2

Targets

- Target
  
  06cfe7f5d88e82f7adda6d8333ca8b302debb22904c68a942188be5730e9b3c8
- Size
  
  59KB
- MD5
  
  91e2807955c5004f13006ff795cb803c
- SHA1
  
  a3e7561de73378b453186a6c33858bf47577d69c
- SHA256
  
  06cfe7f5d88e82f7adda6d8333ca8b302debb22904c68a942188be5730e9b3c8
- SHA512
  
  5d98bc32af83462938633c0d2b692d5b69c9c6151459aefc1276d41947e2514c444ed417c19b39b9c5b8d5359dee5fa2d3f7c8c30ae9f2a687cd02ec3a7b6311
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yln/pY23W58:0x7Fu4/ihrhDTV1yl/SZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (148) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2
- Target
  
  0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d
- Size
  
  59KB
- MD5
  
  885fc8fb590b899c1db7b42fe83dddc3
- SHA1
  
  c104056f9a926d27a2082f0510c97b09cb0eb3e5
- SHA256
  
  0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d
- SHA512
  
  2b8e49ad84434dcaf98635120ac54bfa7e55bb61bf9d0e3f1f25ab81e950f638311d2121217bf5840834778d5e137551e24b89da02f12dc6be99d755c54f4c13
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3XsY23W58:0x7Fu4/ihrhDTV1ylHXZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (178) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral3 behavioral4
- Target
  
  12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975
- Size
  
  59KB
- MD5
  
  c830512579b0e08f40bc1791fc10c582
- SHA1
  
  2fc8514367d4799d90311b1b1f277b3fca5ca731
- SHA256
  
  12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975
- SHA512
  
  b8e7dc2b26ff00c43dae3e5ceb2b241bc7211c52fba167f1dfd81b285461fd53668953ede798a5f4fd1c587ee9861c2ca0fd034a958428dd3d9f5177c61b5ca3
- SSDEEP
  
  768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1ylBpoT6Y23W5o:BpDtG4nMpboDTV1ylXsZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (157) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral5 behavioral6
- Target
  
  151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5
- Size
  
  59KB
- MD5
  
  9d418ecc0f3bf45029263b0944236884
- SHA1
  
  eeb28144f39b275ee1ec008859e80f215710dc57
- SHA256
  
  151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5
- SHA512
  
  82ced42a32f18ede4358459e08bed1adff85d49c952aca7a086571c5b71fd8b3185ea4306abd1f4e639a12f11161f43c73bf6049d76902d365c5a5e4c7e71f3d
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvD7Y23W58:0x7Fu4/ihrhDTV1ylbcZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (155) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral7 behavioral8
- Target
  
  1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43
- Size
  
  40KB
- MD5
  
  1a700f845849e573ab3148daef1a3b0b
- SHA1
  
  c91ff86a88038b00d9190ebb01e6f8c94b0c83e0
- SHA256
  
  1667e1635736f2b2ba9727457f995a67201ddcd818496c9296713ffa18e17a43
- SHA512
  
  d7fcf0ef26bbe1d6104c098711ccdfd33655e62045f6975dd3c48ab34888c83b771dfd07682004943bab86b2dbcb7905364becead09c37de3da0b28e8265dc81
- SSDEEP
  
  384:woyzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpIN:wo4EpThIpEdauX3hS/sj5kGudUj9Vg
Score

3^/10
behavioral10 behavioral9
- Target
  
  17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
- Size
  
  59KB
- MD5
  
  cfcfb68901ffe513e9f0d76b17d02f96
- SHA1
  
  766b30e5a37d1bc8d8fe5c7cacc314504a44ac1f
- SHA256
  
  17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
- SHA512
  
  0d26fa9478f4626107e38c570d1bae1049b744181cf0395d95fb07675575ca393d88d4783bf31bdf11bef1da5648a5a53a6d95b21492f96b4de35c0ec323ae0c
- SSDEEP
  
  768:9jjV7Iax7F3DS4/S96/P3rsAc4ci5pwwX5+R4VYY23W5:vx7Fu4/i6/P3rlckx5+R4VDZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (189) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  
  1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb
- Size
  
  59KB
- MD5
  
  6a7fdab1c7f6c5a5482749be5c4bf1a4
- SHA1
  
  4e6d303d96621769b491777209c237b4061e3285
- SHA256
  
  1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb
- SHA512
  
  39446ebfae1dd0e007e81087f42021b95ee5a0a04e22ca7f4f5addbea4e71c7fe09ffd3bf953400955ce6d31b535c81a37b018aba73c30e61575b2c49414d6cd
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvMpY23W58:0x7Fu4/ihrhDTV1ylvMSZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (154) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral13 behavioral14
- Target
  
  243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
- Size
  
  59KB
- MD5
  
  0ed51a595631e9b4d60896ab5573332f
- SHA1
  
  7ae73b5e1622049380c9b615ce3b7f636665584b
- SHA256
  
  243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
- SHA512
  
  9bfd6318b120c05d9a42a456511efc59f2be5ad451baa6d19d5de776e2ff74dbee444c85478ee7cfdbf705517cc147cd64c6814965f76c740fe1924594a37cb5
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3RYY23W58:0x7Fu4/ihrhDTV1ylhZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (170) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral15 behavioral16
- Target
  
  27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f
- Size
  
  59KB
- MD5
  
  3fd9b0117a0e79191859630148dcdc6d
- SHA1
  
  cf04fa736baf22a2ca4e67f1c7723f1776267e28
- SHA256
  
  27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f
- SHA512
  
  c5175720f432c157eb34da92b29a15f1d7cee77240be12289d5cdb52419dd448b2081a579f783fd48d6226d49057eb3e79f38d85d335761089386a621d1419de
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9NbnASghx2/ZGNePXPz+3+sT9BmXkY23W58:0x7Fu4/iNbASw2xGNaXrtsp2/Z58
Score

10^/10

ransomware spyware stealer darkside
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (187) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral17 behavioral18
- Target
  
  3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6
- Size
  
  59KB
- MD5
  
  c4f1a1b73e4af0fbb63af8ee89a5a7fe
- SHA1
  
  5604a48ce74124fb478049976db48197896b6743
- SHA256
  
  3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6
- SHA512
  
  67e6b184b926b1de2fa1d4c429db33b4b4146a0c5eb6929422d6ec161654fc634dce7810a1deb0befdf7d932df1edfc02251d8193272c1d1c713a1df8da32ceb
- SSDEEP
  
  768:Dbj5aI1NaUzt023Zexasb1w/WF4BtCCuSbVQdNcxGV1ylqdwB:FNaUzt02pSaq1wT4rxDTV1ylqdwB
Score

3^/10
behavioral19 behavioral20
- Target
  
  43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
- Size
  
  59KB
- MD5
  
  f9fc1a1a95d5723c140c2a8effc93722
- SHA1
  
  ce2480dec2ee0a47549fad355c3cf154f9aab836
- SHA256
  
  43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
- SHA512
  
  3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11
- SSDEEP
  
  768:9jjV7Iax7F3DS4/S9F+YeYf+tB1tJq5c2yGHMwY23W5:vx7Fu4/iF5eTtJq1sLZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (160) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral21 behavioral22
- Target
  
  48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a
- Size
  
  226KB
- MD5
  
  c81dae5c67fb72a2c2f24b178aea50b7
- SHA1
  
  4bd6437cd1dc77097a7951466531674f80c866c6
- SHA256
  
  48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a
- SHA512
  
  30d63e080f37f34fb29fd46f8fb1572d79f645154a002c8da5914ae3d51e224bc60601f91f5d58ac2ce9f81d56a8ad467d7fde55d429ed269df3c196e6687b2c
- SSDEEP
  
  6144:UQyTTOip6TGcWnsmx7KbYrBPIJqcKxxY1:E3gGcWnNJIJqDxxY
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (136) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral23 behavioral24
- Target
  
  508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add
- Size
  
  59KB
- MD5
  
  69ec3d1368adbe75f3766fc88bc64afc
- SHA1
  
  11936a92144ef1b53eef16566a57b9052d173291
- SHA256
  
  508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add
- SHA512
  
  58f0f04cb05221e9a50eab89924c45bccc15045e9552e10f39ebbb651eddc5d4fafd95a1ba80f4a6ab8d23c4d3dfff7669e2499650b328420c766cae82e439e8
- SSDEEP
  
  768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1ylQ+IxGY23W5o:BpDtG4nMpboDTV1ylnIfZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (185) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral25 behavioral26
- Target
  
  516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
- Size
  
  56KB
- MD5
  
  84c1567969b86089cc33dccf41562bcd
- SHA1
  
  53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2
- SHA256
  
  516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
- SHA512
  
  72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa
- SSDEEP
  
  768:AiN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy81XweyetnR9Wsf5AyT9G3kZ:r4HHerjZX7pLken5nWXWi
Score

10^/10

darkside ransomware
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (136) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral27 behavioral28
- Target
  
  533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d
- Size
  
  59KB
- MD5
  
  0e178c4808213ce50c2540468ce409d3
- SHA1
  
  38b5aa765026dffbb603e323333294b5f5efa5ee
- SHA256
  
  533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d
- SHA512
  
  262a8f4808f6c3499c9eb465b480508ed6b082ddd36cf2e618a9455b5abbc2eb6a8d7b7c2f398faaa62ffb22599a8b2eec0d3137fdec648de37ac4a73e6f44f4
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylgoVHuY23W58:0x7Fu4/ihrhDTV1yljH5Z58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (146) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral29 behavioral30
- Target
  
  6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff
- Size
  
  59KB
- MD5
  
  5ff75d33080bb97a8e6b54875c221777
- SHA1
  
  810d6c70a96584486867cedde111a1087ed1ebe7
- SHA256
  
  6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff
- SHA512
  
  a6b87ddcaa797a4d8abc06a786a7186fe43eef5e3291402f81b95a180b7fb746f88cd0f408a089deb5321ecf0d2ac3cca479fdc1f782771749df0ac5a082ac00
- SSDEEP
  
  768:9jjV7Iax7F3DS4/S9QCuUSbVtdNcxGV1ylMRY23W5:vx7Fu4/irrUDTV1ylMqZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (163) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Defacement

T1491

Resource Development

Reconnaissance

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Renames multiple (148) files with added filename extension

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (178) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (157) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (155) files with added filename extension

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (189) files with added filename extension

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Renames multiple (154) files with added filename extension

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (170) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (187) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (160) files with added filename extension

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Renames multiple (136) files with added filename extension

Reads user/profile data of web browsers

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Renames multiple (185) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (136) files with added filename extension

Enumerates connected drives

Drops file in System32 directory

Sets desktop wallpaper using registry

DarkSide

Renames multiple (146) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry