Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61

  • Size

    59KB

  • MD5

    cfcfb68901ffe513e9f0d76b17d02f96

  • SHA1

    766b30e5a37d1bc8d8fe5c7cacc314504a44ac1f

  • SHA256

    17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61

  • SHA512

    0d26fa9478f4626107e38c570d1bae1049b744181cf0395d95fb07675575ca393d88d4783bf31bdf11bef1da5648a5a53a6d95b21492f96b4de35c0ec323ae0c

  • SSDEEP

    768:9jjV7Iax7F3DS4/S96/P3rsAc4ci5pwwX5+R4VYY23W5:vx7Fu4/i6/P3rlckx5+R4VDZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (179) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb

  • Size

    59KB

  • MD5

    6a7fdab1c7f6c5a5482749be5c4bf1a4

  • SHA1

    4e6d303d96621769b491777209c237b4061e3285

  • SHA256

    1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb

  • SHA512

    39446ebfae1dd0e007e81087f42021b95ee5a0a04e22ca7f4f5addbea4e71c7fe09ffd3bf953400955ce6d31b535c81a37b018aba73c30e61575b2c49414d6cd

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvMpY23W58:0x7Fu4/ihrhDTV1ylvMSZ58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (184) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3behavioral4

• • Target

    243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60

  • Size

    59KB

  • MD5

    0ed51a595631e9b4d60896ab5573332f

  • SHA1

    7ae73b5e1622049380c9b615ce3b7f636665584b

  • SHA256

    243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60

  • SHA512

    9bfd6318b120c05d9a42a456511efc59f2be5ad451baa6d19d5de776e2ff74dbee444c85478ee7cfdbf705517cc147cd64c6814965f76c740fe1924594a37cb5

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3RYY23W58:0x7Fu4/ihrhDTV1ylhZ58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (149) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral5behavioral6

• • Target

    27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f

  • Size

    59KB

  • MD5

    3fd9b0117a0e79191859630148dcdc6d

  • SHA1

    cf04fa736baf22a2ca4e67f1c7723f1776267e28

  • SHA256

    27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f

  • SHA512

    c5175720f432c157eb34da92b29a15f1d7cee77240be12289d5cdb52419dd448b2081a579f783fd48d6226d49057eb3e79f38d85d335761089386a621d1419de

  • SSDEEP

    768:vjjmbIax7F3DS4/S9NbnASghx2/ZGNePXPz+3+sT9BmXkY23W58:0x7Fu4/iNbASw2xGNaXrtsp2/Z58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral7behavioral8

• • Target

    3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6

  • Size

    59KB

  • MD5

    c4f1a1b73e4af0fbb63af8ee89a5a7fe

  • SHA1

    5604a48ce74124fb478049976db48197896b6743

  • SHA256

    3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6

  • SHA512

    67e6b184b926b1de2fa1d4c429db33b4b4146a0c5eb6929422d6ec161654fc634dce7810a1deb0befdf7d932df1edfc02251d8193272c1d1c713a1df8da32ceb

  • SSDEEP

    768:Dbj5aI1NaUzt023Zexasb1w/WF4BtCCuSbVQdNcxGV1ylqdwB:FNaUzt02pSaq1wT4rxDTV1ylqdwB

  Score

  3^/10
  behavioral10behavioral9

• • Target

    43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa

  • Size

    59KB

  • MD5

    f9fc1a1a95d5723c140c2a8effc93722

  • SHA1

    ce2480dec2ee0a47549fad355c3cf154f9aab836

  • SHA256

    43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa

  • SHA512

    3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11

  • SSDEEP

    768:9jjV7Iax7F3DS4/S9F+YeYf+tB1tJq5c2yGHMwY23W5:vx7Fu4/iF5eTtJq1sLZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (154) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral11behavioral12

• • Target

    48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a

  • Size

    226KB

  • MD5

    c81dae5c67fb72a2c2f24b178aea50b7

  • SHA1

    4bd6437cd1dc77097a7951466531674f80c866c6

  • SHA256

    48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a

  • SHA512

    30d63e080f37f34fb29fd46f8fb1572d79f645154a002c8da5914ae3d51e224bc60601f91f5d58ac2ce9f81d56a8ad467d7fde55d429ed269df3c196e6687b2c

  • SSDEEP

    6144:UQyTTOip6TGcWnsmx7KbYrBPIJqcKxxY1:E3gGcWnNJIJqDxxY

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (150) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral13behavioral14

• • Target

    508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add

  • Size

    59KB

  • MD5

    69ec3d1368adbe75f3766fc88bc64afc

  • SHA1

    11936a92144ef1b53eef16566a57b9052d173291

  • SHA256

    508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add

  • SHA512

    58f0f04cb05221e9a50eab89924c45bccc15045e9552e10f39ebbb651eddc5d4fafd95a1ba80f4a6ab8d23c4d3dfff7669e2499650b328420c766cae82e439e8

  • SSDEEP

    768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1ylQ+IxGY23W5o:BpDtG4nMpboDTV1ylnIfZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (162) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral15behavioral16

• • Target

    516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b

  • Size

    56KB

  • MD5

    84c1567969b86089cc33dccf41562bcd

  • SHA1

    53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2

  • SHA256

    516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b

  • SHA512

    72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa

  • SSDEEP

    768:AiN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy81XweyetnR9Wsf5AyT9G3kZ:r4HHerjZX7pLken5nWXWi

  Score

  10^/10

  darksideransomware

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (175) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral17behavioral18

• • Target

    533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d

  • Size

    59KB

  • MD5

    0e178c4808213ce50c2540468ce409d3

  • SHA1

    38b5aa765026dffbb603e323333294b5f5efa5ee

  • SHA256

    533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d

  • SHA512

    262a8f4808f6c3499c9eb465b480508ed6b082ddd36cf2e618a9455b5abbc2eb6a8d7b7c2f398faaa62ffb22599a8b2eec0d3137fdec648de37ac4a73e6f44f4

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylgoVHuY23W58:0x7Fu4/ihrhDTV1yljH5Z58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (151) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral19behavioral20

• • Target

    6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff

  • Size

    59KB

  • MD5

    5ff75d33080bb97a8e6b54875c221777

  • SHA1

    810d6c70a96584486867cedde111a1087ed1ebe7

  • SHA256

    6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff

  • SHA512

    a6b87ddcaa797a4d8abc06a786a7186fe43eef5e3291402f81b95a180b7fb746f88cd0f408a089deb5321ecf0d2ac3cca479fdc1f782771749df0ac5a082ac00

  • SSDEEP

    768:9jjV7Iax7F3DS4/S9QCuUSbVtdNcxGV1ylMRY23W5:vx7Fu4/irrUDTV1ylMqZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (205) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral21behavioral22

• • Target

    6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8

  • Size

    40KB

  • MD5

    1c33dc87c6fdb80725d732a5323341f9

  • SHA1

    0aea126a9d01fc5faf06314529b4ff06fdc6f8cd

  • SHA256

    6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8

  • SHA512

    50f915e355e66c264d1eaad3bda01034c99ddc8fdc78b03c653ef0ccb4a250e3d892c3b6131fd153c5b73b0ab7c6649c8465ff8dc02f42efb050f8f76906197b

  • SSDEEP

    384:coyzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpIN:co4EpThIpEdauX3hS/sj5kGudUj9Vg

  Score

  3^/10
  behavioral23behavioral24

• • Target

    68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7

  • Size

    59KB

  • MD5

    9e779da82d86bcd4cc43ab29f929f73f

  • SHA1

    e6b47869caa776840ab79856b04096152103c71d

  • SHA256

    68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7

  • SHA512

    e0a172b862054b63c26e8852019cbd46b68c6102e4bae802ba851ae950798d336295795c0cc5d68002a0467c62e5800f1ecfdae05de2709d57bcc31375276bb7

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylzrQ/8P+hY23W58:0x7Fu4/ihrhDTV1ylzrzPdZ58

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (159) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral25behavioral26

• • Target

    691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5

  • Size

    59KB

  • MD5

    e44450150e8683a0addd5c686cd4d202

  • SHA1

    8c482a0eed33c8a4542c3cb2715a242f2259343d

  • SHA256

    691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5

  • SHA512

    7d65d22ad630fd77c50e277a44fdcc46fa86235c93524f9751ac9ddf0ce19261707fab631108fc908a71029900dbf6ada119d607edfadc3ce309f86a9c3765fe

  • SSDEEP

    768:Qbj6iIq6oSqww3/T8K5UWCTxdCCDSbVrdNcxGV1ylwPhpuc:s6VqwwvAKa/TxoCODTV1ylEc

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (150) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral27behavioral28

• • Target

    78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134

  • Size

    59KB

  • MD5

    47a4420ad26f60bb6bba5645326fa963

  • SHA1

    7a29a8f5e14da1ce40365849eb59487dbb389d08

  • SHA256

    78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134

  • SHA512

    08c82585fbab8e090e67e4571f7428bffaf68f9a8c2e34b72f9688205ee880a6435aa813b8845a0b0281c80b78774b969032cc27fc98d3f0e67116dabcf77127

  • SSDEEP

    768:bjjeDIax7F3DS4/S9zDCuUSbVydNcxGV1ylfNY23W5:Qx7Fu4/iSrXDTV1yluZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (177) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral29behavioral30

• • Target

    8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc

  • Size

    59KB

  • MD5

    04fde4340cc79cd9e61340d4c1e8ddfb

  • SHA1

    88fc623483f7ffe57f986ed10789e6723083fcd8

  • SHA256

    8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc

  • SHA512

    105ddfb8bbfedc8460fb1e6d26c6cd02ea81bfdc12a196c1c2f8e52bc73faf03a688339b4c231ab5b5b3885f2ad248115c32c95fc64e84462a16c3e237e6fc9c

  • SSDEEP

    768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1yldoZrY23W5o:BpDtG4nMpboDTV1ylVZ5

  Score

  10^/10

  darksideransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (163) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Sets desktop wallpaper using registry

    ransomware
  behavioral31behavioral32