darkside

General

Target

acb23245ab5c6d1a478f11f3b58e7cde9032827445ad6ab4dcf99ecddfea88d9
Size

31KB
Sample

240419-wzhtlsbh38
MD5

0a54471656cae74df553eca5a477b0cd
SHA1

8235d8dcc7a7375c34f271014e1a104c6906adfa
SHA256

acb23245ab5c6d1a478f11f3b58e7cde9032827445ad6ab4dcf99ecddfea88d9
SHA512

1ea695ea12aa6494a9f6892435e325db890514d4e1f326ef48c9288c69d6a0131f126a1bf0e9957f3df521cf44721823b6abd28e8a1cb98fd11234b49dba75d7
SSDEEP

768:s20F3Is9a4hKqhCUBD7DZadbul5dd/7B6kOi/mZAx201d:pida4IqAUBnZ6bul5dZwNi/bX

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\README.b565854b.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT When you open our website, put the following data in the input form: Key: 0kZdK3HQhsAkUtvRl41QkOdpJvzcWnCrBjjgg5U4zfuWeTnZR5Ssjd3QLHpmbjxjo7uWzKbt8qPVuYN38TsDPI3bemd5I40ksemIzuI5OhIHZsi9cn3Wpd7OUT72FP9MyAUzR586yMsI2Ygri9in0Bf4EkG0pmBOLyRG1T788foGJQW1WxS1Qd2sMVvX0jKlbGG1zLp7g0u6buDCzSMyTjWjuVzJYufBBv7S2XvciEVvboiTNbZA4UUU6PttKERQSb018aILd6xO3ulk6fbEgZDO5tZSGn2zRevn5YXnHtg6vt1ToLe3izQOgYbs8Ja1fkfJBUYVux1ITyWBjpn0xPayKfwln8SqgMkbqiDyxEDEtFhqiffLcONMhi4TmW50loZIC6mWSaOjThWp6XSJUWPtY8Mkzs8Cs0qjPahx58iAEVIRGUVpLkMs7xPN7ydZ6wMWaOcRC1AD1JEUVTjLikXXyckgYaS6FnEv0UNEsv6QbTLSpDomIg3rEYZBib6ozrwH5n0M5wrKo8NciUBmfJWDP4XKkjznpsa05rEpuAklM0dMmZsYGVR !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/CZEX8E0GR0AO4ASUCJE1K824OKJA1G24B8B3G0P84LJTTE7W8EC86JBE7NBXLMRT

Targets

- Target
  
  124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a
- Size
  
  59KB
- MD5
  
  01cef4d4f9306177d42f221854ee552b
- SHA1
  
  e06c0d3ae9eb341182e937f44906c240cff4c057
- SHA256
  
  124e83f0812629fbc7ee0330002d7e5026b0f79e29a7d42facd62dd67b83549a
- SHA512
  
  5ebba89c40862be7405ec41979d4fa6916a2742ba8c2ca5c81c5b9002e9497e54b0281fcad1fac6676e6c3b491e9a777536c6d1ef19a52986e15286a24cff95e
- SSDEEP
  
  768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yltqZrY23W58:0x7Fu4/ihrhDTV1ylEZMZ58
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (141) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2