darkside

Resubmissions

27-01-2024 19:37

240127-yb5pksafd3 10

27-01-2024 19:36

240127-ybqwesafc2 10

12-05-2021 15:56

210512-db4t7vmwas 10

Sharing

Copy URL

Twitter E-mail

General

Target

5196509513285632.zip
Size

15.6MB
Sample

240127-ybqwesafc2
MD5

a9f3fe11971ef3a634767f345ff8db86
SHA1

3895b734e6de23ee5e3fdcdc35b2df5ae5223ec6
SHA256

0f808fd3ecf9d722aafeee46b57aad4d07f39c98be6f6148be979ed470cf0a99
SHA512

1268b1ab9c9891a4e6d20f17fdc61c2c85971ad2efb6e8d00f7a0cdb59613a2f9c1ec4c72bddab03c8e7c62f07d694860808928edb4a8ced41438f2b4c2a9edf
SSDEEP

393216:Y+ITF20rAgtw8FFy0nMlTKo6pa9JzyzbzS3klSYi:Yzo0rAR8FFyVb6MLLklSYi

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\README.7d1d1ad3.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 90 GB data. These files include: Finance data Insurance data Buchgalting Data Banking data and details, bank contracts, creditors info Much personal data Marketing data Production, Technik data Email conversations dump and more others. All documents are fresh (last 365 days) and stored on our offline servers. All data will be published piece by piece. First data pack will be published in 7 days if we do not come for agreement. Your personal leak page: http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF On the page you will find examples of files that have been stolen. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH When you open our website, put the following data in the input form: Key: rIzr2nCuqbQL7MGMwoppaucqSp5AZufUiYhssYa1SGfO0XFf09fBDlLDWgKQSnnvIAfqYTsOgUhOTxzbxGsC9nH0yk2HOFhn7t8ntX8L0evyce8vKdgUKF7Xvjn6ljaQQ4HPEfPZFP2jvN0DgBVWl2WgNT1U3owZ1bNBjps34t33ObZc01Ce1yKx5CSlwUYbw1ktjqt5d7R9DwRL3NIGrTHvMX3qXI5aBAUnirnc4zHtfGPXq4CuFoh04Tv7VE81aohfvuz8D7wo7i28sbILoJyF6mzeQwSkAXolOhXKQAEPsGcdbfLxfY5uILkHB3d1gAyxT1owQXsY4heNQbY3yYL1Em7dDaLdbNhOf0adYWFiFfAl9EwLDRT96L9Xzsk17ho1B82wOWZ79ZqtT8yqnZ4APJb1LO91ASSsgUdNvR0lAaZTfXHHxUI1vDm5ygyV7cbxMlrQ5K1U6ughdd5WosogMJWVNjreirhzuDzY6SnixtukGYG0D9azzgOHcgidJcLV4n0orhzIaA1SMNYOpdOIadgBehCaHwEyr3hn8CEa6fgpUgK6E95 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF

http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH

Extracted

Path

C:\Users\Admin\README.f304bbf4.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/DZYNTXY9RP5P8DQ96EFKV2YTOVAMA3VVHL5V0RASUBLBWZGLG51U4LOOBSHV9R0Y

Extracted

Path

C:\Users\README.e1ae59a5.TXT

Family

darkside

Ransom Note

----------- [ Welcome to Dark ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 100 GB data. Example of data: - Accounting data - Executive data - Sales data - Customer Support data - Marketing data - Quality data - And more other... Your personal leak page: http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68 When you open our website, put the following data in the input form: Key: pr9gzRnMz6qEwr6ovMT0cbjd9yT56NctfQZGIiVVLgo0ME2EQpAUyZucG9BLrOJjno5XLPvCN11TFfnlFHa42u5mJxoeR5k5RUgQAC1MC6LBUj4YOOAUyiBrR HQSUM3pzGoEPRVOzXSZ8YqkJyFL0TDFBbWaBKQDOSo9GzKKoVRQ0Eb02F5geTPkTAqZZSfSQ6PBBlTGPSgGe2kCyuwwp7lDmRSJlNnHssMMZHVhXzyZ6fxiBY gNiuusFK8JNI5nrtRPp3bMAc6OEddxfJWj6o2GT1Xg9j87Jp4Oyv43E1J61jLJAWBkmoBB3Gqv07mtyDW5PnmxBlNzABbLFEvJMQL23sR8nnw4svzcZHxrqD1 xRcxqyeKtsaQ5yqLvyQgMdnrI2QoCqkHYYUfBIzjO8BXyBZdmjHanXE57jdDAhjaDUUqfL917cCyJr1uwVR0Xj5lJXe8BIKHd3dFrz70CsIXFAhicOsBlFzIn daNcAXXyL8Fg1avIXOcuEkGRDXt8Cs8b3TAB6n4DrbLJdiFjECo8yCA9pxvzqjXatumUloblWFZaUoLVYzP !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC

http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68

Extracted

Path

C:\Users\Admin\README.47246f95.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/OBB5DDMR8RB9DI2RYYF376YGBJAV2J4F2NXFEWPBSXY709MAA0MY7PMBBQJ0HVG3

Extracted

Path

C:\README.b2100882.TXT

Family

darkside

Ransom Note

URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/XES2TUV3A9QL89IS7QX91V7TYSF13ASPGB2TASQ68R9Z6QYH69OVY833QSRSFU4I

Extracted

Path

C:\Users\Admin\README.21af4d10.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/VGBU8VAXXW7EYB5U4KQJXUGU5NT5FP8208W6UXVSKQDAE3CNBR4JTZQCXEZFZWF2

Extracted

Path

C:\Users\Admin\README.398da5ec.TXT

Family

darkside

Ransom Note

URLs

http://darksidfqzcuhtk2.onion/45NAQ3FNBX002JPHBAIKB97JVVABJQHTM2HO7XOZRXTEH98CRPXYX09X7VUH0F0W

Extracted

Path

C:\Users\Admin\README.d4f081ca.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 30GB data. These files include: - Accounting - Finance - Internal documents - Insurance Your personal leak page: http://darksidedxcftmqa.onion/blog/article/id/88/EbDyhFDs_z2hYxVR0XHv4S3ZzHUrKh4rqa3bgZ44Og-ORPgEAgMjzoTDuM46leXv On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/KB0LXKYKN6E96Z7RFYWCEI6NM03TX93VZCL5EDA4IVPXUIQQZBG2ZEG269ZIFSFM When you open our website, put the following data in the input form: Key: 9mMrqcP7meAPxAvXF25ONPJ4KqIozRuGzFKqvsN4XCuThdVZqteuONtPOu4gYqMXcEcWUx5wELPmbMsI2CcmFySRZJDqPLc8rvxUGJg12wuZki8EizCFaG5L8oQTfgOCvMrTkxmSmVhcSjQt340z9fXWhyQzy96XBkwAzIWp5uviJyAZ9ZBKDlodGa6SDkIFdYVlVQi7R9qzQE4G2KqmQ6Tmim4kCalkH4dBxGYkUC1wCyCncUMAWD7egCaKoKGlHiK99ANxmxFulbvoV8vjn2ArqDm46RNzoMk8C9QGpPsPL0GGppW1izBwguSXug4DrPjvvAmZVJzLrGx0LEH8srhneZnfrSLHm2tDwmOog8obV8IMYF41AuvVX1JyzDkhU282ECvBXDBb7URumIHdSnnVOKCVTKmuC1R3srHwxmd6RweVC1IkvHD7Bt7ybXffJVfRkyhMdpXHLREpoWItO1tlQZxvBUKZlrd7hJGSwZSlR3NWx61XMxuptxrXt7ZOHNJ4AkeJ2FvepgCazbuV57FP38CVC4mHsxyBWCDioj4RmEhA0AMn5Z5 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/blog/article/id/88/EbDyhFDs_z2hYxVR0XHv4S3ZzHUrKh4rqa3bgZ44Og-ORPgEAgMjzoTDuM46leXv

http://darksidfqzcuhtk2.onion/KB0LXKYKN6E96Z7RFYWCEI6NM03TX93VZCL5EDA4IVPXUIQQZBG2ZEG269ZIFSFM

Extracted

Path

C:\Users\Admin\README.3d4850a4.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. We downloaded a lot of interesting data from your network. If you need proofs, we are ready to give it. The data is preloaded and will be automatically published if you don’t pay. Your data will be available after automatic publication for free downloading at least 6 months at our tor cdn servers. If within 3 days you don't contact with us, we will send press-releases about this accident to major media outlets, after another 3 days after sending press-releases we will start to upload your private data. Here is the list of information that we copied from your network: Passports and visas from: DOCUMENTS-RED SEA PROJECT DOCUMENTS-VISIT VISA EMPLOYEES IQAMA & PASSPORTS FOR SWAB TEST SCAN DOCUMENTS Contracts and passports as well as test results for SARS-COV19 from: CONTRACT COVID 19 Status Report Passport and photo Accounting & Financing We also copied information from the following departments: RAKFIN RAKHSE RSPDC RSPFIN RSPQLTP RSPSTO RSPTEC SAJSPFIN RSPQLT RAKEENG We paid a lot of attention to the personal data of employees as well as the drawings of your projects You must understand that if information about your developments gets publicly available: 1) your clients data can be used by criminals 2) your clients will fill lawsuit against you 3) government regulators will fine you for data breach, if you have in clients at least one EU resident then you will be also fined by EU government by GDPR law with millions of dollars of fine or permit ban for working with EU citizents. US has the similar laws, but they are not so costly, however the total cost will exceed the asked amount from you, so our offer is the best deal for you to resolve this issue. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/3NQA47J490NLKJVB1FI43HHCEJO62CE3E440J4H4K564VRQ8AFONVJQOM8158NR3 When you open our website, put the following data in the input form: Key: zm7QxFcBLUS2PdXT2XI4gIg6FuXOMT67rYgWK4ZdNE3jt6R6skLNBCiW7ryVA7ej438jGLsBzZ1mog9YLjglfFG3Ezw57Ks0jJQZMO2AokEchnlupHVbK7ZTlk4kDSMP79vNfLUDI8ppzxNTOtcWQLTtzxCI7zb6ufHXbQe5xQUJvwTJbRVmcNib462NddZoyQ0zjKh8GsEPEfQBCkTtiYR8aVMlr0GBQKzQvDmmBks9y0IupRiKMbGf607vVNegtZXEUFXOfhQfnUwOYUAkX4t83P4eQKbPaFTYpasoEC7Xm0XU1SaX3KAagaqDaIH69YQYZOJZaTrc5NtsPPRH7R1HlOMZP2bC3GMsbLaK91saXy9FcDZpn9AFkVVQHlV9xov5GzZ5GMtxb9QUcpth5a12WpVKpi5wdKNc3H3Q4jNqQjkxUJcM35X9Dkie8LKOYvC039zvnTcClzqhNza6mXhgcd7rGSWQZ6EoJ9yn6LOEf8bwjIoHrGqoYQwS6F7ZWeLd5VtbUGE7iObjGj6vdFjqhKLOxeuNhGx4ZyZ5ZR6e5K7uvLZWmYq !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/3NQA47J490NLKJVB1FI43HHCEJO62CE3E440J4H4K564VRQ8AFONVJQOM8158NR3

Extracted

Path

C:\Users\Admin\README.47246f95.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, private data was downloaded. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 300GB data. Your personal leak page (TOR LINK): http://darksidedxcftmqa.onion/homehardware/K4fLrrmO5GOIBHbhfJyN5rG4pkPcRlnc48ceUHtNgjONruPRTVc4Usyb96BuHkKa On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published in our blog if you do not pay. After publication, your data can be downloaded by anyone, it stored on our tor CDN and will be available for at least 6 months. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. HOW TO CONTACT US? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/FJ6BL608YXVN8DGFDP23JVF2RU0K0IC102LSJA09Z2JF14A1SCCJBOVPLRHSLU16 When you open our website, put the following data in the input form: Key: FSGLQojvXe6Tvm2w0wxP3QfWkJb1USBnFsbmL4CiIX0sBiV727ofcmrdJmUTgBStIrH7sgcBDo4SPki6BniKhpd7d4zjLSAxmtlwLAHLgtBnwYPuW05gxF4VPuXsylwu2p3k6ZWDTjCIZVVG04RCYEfS3AP25AWqGkFDh4KVy7MZsCVH7RwxEdhWyApxi7Ioai3v52ofbfNgys0V0sG2xWqJgtluhQ4J23O7jCZxqMM10civs8NlDmeJAiIkI43RrPDd3P2kA03ky3oUBNeUPOOnAztZQezpfAgiM8evd3HE9aua1yUEX4hndxmFU02CEYIiyah3g5ywISASKAeiXKCJoThOot42MHwMCl0G7wP6KdHVyPx8uhBdT2kbzvjGZvmOibfxKUlxJlhai4DhjDp9mUuJajTrBYoeogvOzrgc8iv0PcrAABLRGU2I9uSFIlFqZeuIp7qMW7DIZKrunidyvfL1oTtuosI8bQ0BVvooDC1BB5n5Biw9x2yBNit4lOjMhY00P3wTLvMhS3ZQ6eGKDmx7GrQ7ydGo6I2A0eQx9dpuxhWpkpc !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidedxcftmqa.onion/homehardware/K4fLrrmO5GOIBHbhfJyN5rG4pkPcRlnc48ceUHtNgjONruPRTVc4Usyb96BuHkKa

http://darksidfqzcuhtk2.onion/FJ6BL608YXVN8DGFDP23JVF2RU0K0IC102LSJA09Z2JF14A1SCCJBOVPLRHSLU16

Targets

- Target
  
  17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
- Size
  
  59KB
- MD5
  
  cfcfb68901ffe513e9f0d76b17d02f96
- SHA1
  
  766b30e5a37d1bc8d8fe5c7cacc314504a44ac1f
- SHA256
  
  17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
- SHA512
  
  0d26fa9478f4626107e38c570d1bae1049b744181cf0395d95fb07675575ca393d88d4783bf31bdf11bef1da5648a5a53a6d95b21492f96b4de35c0ec323ae0c
- SSDEEP
  
  768:9jjV7Iax7F3DS4/S96/P3rsAc4ci5pwwX5+R4VYY23W5:vx7Fu4/i6/P3rlckx5+R4VDZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (179) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb
- Size
  
  59KB
- MD5
  
  6a7fdab1c7f6c5a5482749be5c4bf1a4
- SHA1
  
  4e6d303d96621769b491777209c237b4061e3285
- SHA256
  
  1cc7c198a8a2c935fd6f07970479e544f5b35a8eb3173de0305ebdf76a0988cb
- SHA512
  
  39446ebfae1dd0e007e81087f42021b95ee5a0a04e22ca7f4f5addbea4e71c7fe09ffd3bf953400955ce6d31b535c81a37b018aba73c30e61575b2c49414d6cd
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvMpY23W58:0x7Fu4/ihrhDTV1ylvMSZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (184) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral3 behavioral4
- Target
  
  243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
- Size
  
  59KB
- MD5
  
  0ed51a595631e9b4d60896ab5573332f
- SHA1
  
  7ae73b5e1622049380c9b615ce3b7f636665584b
- SHA256
  
  243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60
- SHA512
  
  9bfd6318b120c05d9a42a456511efc59f2be5ad451baa6d19d5de776e2ff74dbee444c85478ee7cfdbf705517cc147cd64c6814965f76c740fe1924594a37cb5
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3RYY23W58:0x7Fu4/ihrhDTV1ylhZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (149) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral5 behavioral6
- Target
  
  27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f
- Size
  
  59KB
- MD5
  
  3fd9b0117a0e79191859630148dcdc6d
- SHA1
  
  cf04fa736baf22a2ca4e67f1c7723f1776267e28
- SHA256
  
  27214dcb04310040c38f8d6a65fe03c14b18d4171390da271855fdd02e06768f
- SHA512
  
  c5175720f432c157eb34da92b29a15f1d7cee77240be12289d5cdb52419dd448b2081a579f783fd48d6226d49057eb3e79f38d85d335761089386a621d1419de
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9NbnASghx2/ZGNePXPz+3+sT9BmXkY23W58:0x7Fu4/iNbASw2xGNaXrtsp2/Z58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (163) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral7 behavioral8
- Target
  
  3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6
- Size
  
  59KB
- MD5
  
  c4f1a1b73e4af0fbb63af8ee89a5a7fe
- SHA1
  
  5604a48ce74124fb478049976db48197896b6743
- SHA256
  
  3dabd40d564cf8a8163432abc38768b0a7d45f0fc1970d802dc33b9109feb6a6
- SHA512
  
  67e6b184b926b1de2fa1d4c429db33b4b4146a0c5eb6929422d6ec161654fc634dce7810a1deb0befdf7d932df1edfc02251d8193272c1d1c713a1df8da32ceb
- SSDEEP
  
  768:Dbj5aI1NaUzt023Zexasb1w/WF4BtCCuSbVQdNcxGV1ylqdwB:FNaUzt02pSaq1wT4rxDTV1ylqdwB
Score

3^/10
behavioral10 behavioral9
- Target
  
  43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
- Size
  
  59KB
- MD5
  
  f9fc1a1a95d5723c140c2a8effc93722
- SHA1
  
  ce2480dec2ee0a47549fad355c3cf154f9aab836
- SHA256
  
  43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
- SHA512
  
  3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11
- SSDEEP
  
  768:9jjV7Iax7F3DS4/S9F+YeYf+tB1tJq5c2yGHMwY23W5:vx7Fu4/iF5eTtJq1sLZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (154) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  
  48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a
- Size
  
  226KB
- MD5
  
  c81dae5c67fb72a2c2f24b178aea50b7
- SHA1
  
  4bd6437cd1dc77097a7951466531674f80c866c6
- SHA256
  
  48a848bc9e0f126b41e5ca196707412c7c40087404c0c8ed70e5cee4a418203a
- SHA512
  
  30d63e080f37f34fb29fd46f8fb1572d79f645154a002c8da5914ae3d51e224bc60601f91f5d58ac2ce9f81d56a8ad467d7fde55d429ed269df3c196e6687b2c
- SSDEEP
  
  6144:UQyTTOip6TGcWnsmx7KbYrBPIJqcKxxY1:E3gGcWnNJIJqDxxY
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (150) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13 behavioral14
- Target
  
  508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add
- Size
  
  59KB
- MD5
  
  69ec3d1368adbe75f3766fc88bc64afc
- SHA1
  
  11936a92144ef1b53eef16566a57b9052d173291
- SHA256
  
  508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add
- SHA512
  
  58f0f04cb05221e9a50eab89924c45bccc15045e9552e10f39ebbb651eddc5d4fafd95a1ba80f4a6ab8d23c4d3dfff7669e2499650b328420c766cae82e439e8
- SSDEEP
  
  768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1ylQ+IxGY23W5o:BpDtG4nMpboDTV1ylnIfZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (162) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral15 behavioral16
- Target
  
  516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
- Size
  
  56KB
- MD5
  
  84c1567969b86089cc33dccf41562bcd
- SHA1
  
  53f2133cb25186e9fa6d4ea3b0e41eee5aba5ef2
- SHA256
  
  516664139b0ddd044397a56482d7308d87c213c320a3151ccb9738e8f932654b
- SHA512
  
  72a411cacd503b6fadb15dc90f1f9beb79ff79c620df76da381e5c780c53e11258aae72db2848c241ec55af403d67d62340e429e86c23bbf8a71287738de7eaa
- SSDEEP
  
  768:AiN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy81XweyetnR9Wsf5AyT9G3kZ:r4HHerjZX7pLken5nWXWi
Score

10^/10

darkside ransomware
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (175) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral17 behavioral18
- Target
  
  533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d
- Size
  
  59KB
- MD5
  
  0e178c4808213ce50c2540468ce409d3
- SHA1
  
  38b5aa765026dffbb603e323333294b5f5efa5ee
- SHA256
  
  533672da9d276012ebab3ce9f4cd09a7f537f65c6e4b63d43f0c1697e2f5e48d
- SHA512
  
  262a8f4808f6c3499c9eb465b480508ed6b082ddd36cf2e618a9455b5abbc2eb6a8d7b7c2f398faaa62ffb22599a8b2eec0d3137fdec648de37ac4a73e6f44f4
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylgoVHuY23W58:0x7Fu4/ihrhDTV1yljH5Z58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (151) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral19 behavioral20
- Target
  
  6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff
- Size
  
  59KB
- MD5
  
  5ff75d33080bb97a8e6b54875c221777
- SHA1
  
  810d6c70a96584486867cedde111a1087ed1ebe7
- SHA256
  
  6228f75f52fd69488419c0e0eb3617b5b894a566a93e52b99a9addced7364cff
- SHA512
  
  a6b87ddcaa797a4d8abc06a786a7186fe43eef5e3291402f81b95a180b7fb746f88cd0f408a089deb5321ecf0d2ac3cca479fdc1f782771749df0ac5a082ac00
- SSDEEP
  
  768:9jjV7Iax7F3DS4/S9QCuUSbVtdNcxGV1ylMRY23W5:vx7Fu4/irrUDTV1ylMqZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (205) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral21 behavioral22
- Target
  
  6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8
- Size
  
  40KB
- MD5
  
  1c33dc87c6fdb80725d732a5323341f9
- SHA1
  
  0aea126a9d01fc5faf06314529b4ff06fdc6f8cd
- SHA256
  
  6836ec8588b8049bcd57cd920b7a75f1e206e5e8bb316927784afadb634ea4d8
- SHA512
  
  50f915e355e66c264d1eaad3bda01034c99ddc8fdc78b03c653ef0ccb4a250e3d892c3b6131fd153c5b73b0ab7c6649c8465ff8dc02f42efb050f8f76906197b
- SSDEEP
  
  384:coyzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpIN:co4EpThIpEdauX3hS/sj5kGudUj9Vg
Score

3^/10
behavioral23 behavioral24
- Target
  
  68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7
- Size
  
  59KB
- MD5
  
  9e779da82d86bcd4cc43ab29f929f73f
- SHA1
  
  e6b47869caa776840ab79856b04096152103c71d
- SHA256
  
  68872cc22fbdf0c2f69c32ac878ba9a7b7cf61fe5dd0e3da200131b8b23438e7
- SHA512
  
  e0a172b862054b63c26e8852019cbd46b68c6102e4bae802ba851ae950798d336295795c0cc5d68002a0467c62e5800f1ecfdae05de2709d57bcc31375276bb7
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylzrQ/8P+hY23W58:0x7Fu4/ihrhDTV1ylzrzPdZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (159) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral25 behavioral26
- Target
  
  691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5
- Size
  
  59KB
- MD5
  
  e44450150e8683a0addd5c686cd4d202
- SHA1
  
  8c482a0eed33c8a4542c3cb2715a242f2259343d
- SHA256
  
  691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5
- SHA512
  
  7d65d22ad630fd77c50e277a44fdcc46fa86235c93524f9751ac9ddf0ce19261707fab631108fc908a71029900dbf6ada119d607edfadc3ce309f86a9c3765fe
- SSDEEP
  
  768:Qbj6iIq6oSqww3/T8K5UWCTxdCCDSbVrdNcxGV1ylwPhpuc:s6VqwwvAKa/TxoCODTV1ylEc
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (150) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral27 behavioral28
- Target
  
  78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134
- Size
  
  59KB
- MD5
  
  47a4420ad26f60bb6bba5645326fa963
- SHA1
  
  7a29a8f5e14da1ce40365849eb59487dbb389d08
- SHA256
  
  78782fd324bc98a57274bd3fff8f756217c011484ebf6b614060115a699ee134
- SHA512
  
  08c82585fbab8e090e67e4571f7428bffaf68f9a8c2e34b72f9688205ee880a6435aa813b8845a0b0281c80b78774b969032cc27fc98d3f0e67116dabcf77127
- SSDEEP
  
  768:bjjeDIax7F3DS4/S9zDCuUSbVydNcxGV1ylfNY23W5:Qx7Fu4/iSrXDTV1yluZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (177) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral29 behavioral30
- Target
  
  8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc
- Size
  
  59KB
- MD5
  
  04fde4340cc79cd9e61340d4c1e8ddfb
- SHA1
  
  88fc623483f7ffe57f986ed10789e6723083fcd8
- SHA256
  
  8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc
- SHA512
  
  105ddfb8bbfedc8460fb1e6d26c6cd02ea81bfdc12a196c1c2f8e52bc73faf03a688339b4c231ab5b5b3885f2ad248115c32c95fc64e84462a16c3e237e6fc9c
- SSDEEP
  
  768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1yldoZrY23W5o:BpDtG4nMpboDTV1ylVZ5
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (163) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral31 behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Defacement

T1491

Resource Development

Reconnaissance

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Renames multiple (179) files with added filename extension

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Renames multiple (184) files with added filename extension

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (149) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (163) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (154) files with added filename extension

Checks computer location settings

Deletes itself

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Renames multiple (150) files with added filename extension

Reads user/profile data of web browsers

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Renames multiple (162) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (175) files with added filename extension

Enumerates connected drives

Drops file in System32 directory

Sets desktop wallpaper using registry

DarkSide

Renames multiple (151) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (205) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Renames multiple (159) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (150) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

DarkSide

Renames multiple (177) files with added filename extension

Reads user/profile data of web browsers

Sets desktop wallpaper using registry

DarkSide

Renames multiple (163) files with added filename extension

Reads user/profile data of web browsers