General
-
Target
darkside.exe
-
Size
17KB
-
Sample
240528-gphnjahh39
-
MD5
9009593ebf5ea20407ab19bff045dc9d
-
SHA1
03c1f7458f3983c03a0f8124a01891242c3cc5df
-
SHA256
6931b124d38d52bd7cdef48121fda457d407b63b59bb4e6ead4ce548f4bbb971
-
SHA512
fe24a401b35a5b1874bc90739f6fda1969456a13e1339f5b920e6fa659e82df0febc7fc3196ea854601e8773c356884a2516b660daafa944c3643b9d0be74fed
-
SSDEEP
384:SGyUrEk/yEoQE+yckIYN/pBa3AWK3T2oTboHblKR/o:l4klFypIYFpB/x9ngbd
Behavioral task
behavioral1
Sample
darkside.exe
Resource
win7-20240508-en
Malware Config
Extracted
C:\Users\README.c2995afb.TXT
darkside
http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC
http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68
Targets
-
-
Target
darkside.exe
-
Size
17KB
-
MD5
9009593ebf5ea20407ab19bff045dc9d
-
SHA1
03c1f7458f3983c03a0f8124a01891242c3cc5df
-
SHA256
6931b124d38d52bd7cdef48121fda457d407b63b59bb4e6ead4ce548f4bbb971
-
SHA512
fe24a401b35a5b1874bc90739f6fda1969456a13e1339f5b920e6fa659e82df0febc7fc3196ea854601e8773c356884a2516b660daafa944c3643b9d0be74fed
-
SSDEEP
384:SGyUrEk/yEoQE+yckIYN/pBa3AWK3T2oTboHblKR/o:l4klFypIYFpB/x9ngbd
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (173) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-