darkside

General

Target

ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108
Size

256KB
Sample

240531-e9a33sfc4y
MD5

d6b0b65300c7f9c0b700ab21f58990cc
SHA1

1148829c7032b7c5907337b20902c70a584710a9
SHA256

ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108
SHA512

e7671432d936a800588859b6c878efba1a0e60b42abc5b0286420dd39cc612f67a2779c1f4d5870060b69446778c6207f6ef840125c73decfa765b910d5e8590
SSDEEP

6144:BG2/9A5wlFbBkPj8uYDJTVmxAznfcFf0UoEF:k2VA5wlFbBkPj8uqJqkfcFfHoE

Score

10^/10

darkside ransomware

Malware Config

Extracted

Path

C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\README.d055bb79.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/86GND2UGQRIP7OXI4KAHWDF3QR4ZDTJ3GGZA02KJYG7H6UDZ2U0DVB03WIUKOK73 When you open our website, put the following data in the input form: Key: RODfvJYqjv0mpxmuTDFwY5lLfDa0AKH3CO9ajV9EjZT2hxfwNztVLmaaEVQ305NtwqN3ThKuAhyiT1lUEPLbOGQYz17oTD1wqPWcYoKXTpFWIAQ23TuI7t2x4wj1Qxjy8SoCgyw2gBn8xwRGonZO6v9eKfe2j3xB4VmaFtpll2ZeKF0BReaSNSNlY7zkKNwxM65kYN4nBvFDT0ZoHYXHtl79bDt471lwrYw4vQJvsPgCa2LPCbinHj0cOLJyko3V3HWd5dOpuO28MAwxRnjcULRYkvobx1HShC6hxETzVOGIWma9XTEi0lzhtlAyp6TVYDydBeHjokOKWIesezWMug65kP2HQBzG66BsOQLjfQiMg8UmA8OsnuU1fcj6PljgdqvIF63ENiRBBW8NdUTOnqQQHhf4cRLb2gLAW7IrBx4bWrNyiPE9vNsOeWZ5Yf3MIXwTPs9hXRDMdGo9hbuD9gcniyIHHpxcrM4XNoxetF8JDB4vyC7dZizspkX1f2BwkpVxFSKv8tOgcpFwtR5yMiRYjrU51LEIAU8UK9olpKDl3WSeCpw8QqN !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://dark24vx6fsmdrtbzdzjv6ckz4yqyued4uz455oqpctko7m6vbrzibad.onion/86GND2UGQRIP7OXI4KAHWDF3QR4ZDTJ3GGZA02KJYG7H6UDZ2U0DVB03WIUKOK73

Targets

- Target
  
  ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108
- Size
  
  256KB
- MD5
  
  d6b0b65300c7f9c0b700ab21f58990cc
- SHA1
  
  1148829c7032b7c5907337b20902c70a584710a9
- SHA256
  
  ea3c8766df6f8390dd6a0e411cec77eb8f5df0556935ea1d217f1938454d3108
- SHA512
  
  e7671432d936a800588859b6c878efba1a0e60b42abc5b0286420dd39cc612f67a2779c1f4d5870060b69446778c6207f6ef840125c73decfa765b910d5e8590
- SSDEEP
  
  6144:BG2/9A5wlFbBkPj8uYDJTVmxAznfcFf0UoEF:k2VA5wlFbBkPj8uqJqkfcFfHoE
Score

10^/10

darkside ransomware
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (159) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2