General

  • Target

    2024-03-13_66b3e535355102fd0cede6506739e474_darkside

  • Size

    147KB

  • Sample

    240313-v4tk8sba3y

  • MD5

    66b3e535355102fd0cede6506739e474

  • SHA1

    5a20c4d8bbb2495c817c92cfa060a6a235e6ed36

  • SHA256

    9b3cd385077933c2a72cba58d23dcde77852818c3ce1a361baa5c6bbd915b82f

  • SHA512

    f11bd1ed1f2f601ed5db353ff2f85982b3218e3a60f6d58c8f5f5a23df7560fce8fd67da37fe7ef6bc31de2883eb17c2389a1195820968562740a0e46c1569e6

  • SSDEEP

    3072:T6glyuxE4GsUPnliByocWepjUeRBGYENO6g:T6gDBGpvEByocWexUeR0Y2N

Malware Config

Extracted

Path

C:\NupqqeiS5.README.txt

Ransom Note
What happens? Your network is encrypted, and currently not operational. e need only money, after payment we wil1 give you a decryptor for the entire network and you wil1 restore al1 the data. >>>> What data stolen? From your network was stolen sensitive data. If you do not contact us we wil1 publish al1 your data in our blog and wil1 send it to the biggest mass media. >>>>What guarantees?We are not a politically motivated group and we do not need anything otherthan your money.If you pay, we will provide you the programs for decryption and we will delete your data.If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goalsWe always keep our promises. >>>>Pay ransom amount contact Email:[email protected] >>>>Payment cryptocurrency address USDT-TRC20 >>>>TTpEpsPpRH5KSWyqfK1KEvsrJSYKcjbxJ9 >>>>payment is completed, send the payment photo to Email: [email protected] >>>>payment is completed Send via email we will provide you the programs Sometimes you will need to wait for our answer because we attack many companies. we will provide you the programs Warning! Recovery recormnendations. We strongly recommend you to do not MODIFY or REPAIR your files, that wil1 damage them
Emails

Targets

    • Target

      2024-03-13_66b3e535355102fd0cede6506739e474_darkside

    • Size

      147KB

    • MD5

      66b3e535355102fd0cede6506739e474

    • SHA1

      5a20c4d8bbb2495c817c92cfa060a6a235e6ed36

    • SHA256

      9b3cd385077933c2a72cba58d23dcde77852818c3ce1a361baa5c6bbd915b82f

    • SHA512

      f11bd1ed1f2f601ed5db353ff2f85982b3218e3a60f6d58c8f5f5a23df7560fce8fd67da37fe7ef6bc31de2883eb17c2389a1195820968562740a0e46c1569e6

    • SSDEEP

      3072:T6glyuxE4GsUPnliByocWepjUeRBGYENO6g:T6gDBGpvEByocWexUeR0Y2N

    • Renames multiple (329) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks