darkside

General

Target

00ca7e42b298d5e2a06050b527abef40_NeikiAnalytics.exe
Size

259KB
Sample

240603-zmn2msaa83
MD5

00ca7e42b298d5e2a06050b527abef40
SHA1

b343760bff3f0c6adbd9b5b39e65894be6d550a5
SHA256

6183d9296b128c378e32228916ec2d34fc1cee19b84bcdcf6ff8dcb2e6492a42
SHA512

6e24df07d15b1dbe3da753aa6730685729490285d83397e7f140c592a45d1ecdb33c7cbd15c48bd3c4f803cff55c655f86d7523187a770a434f85f795dcba4c6
SSDEEP

6144:j9Iuq5yqBxgxIlrfImRCW2cqv7pLR1N1e9ORXrP4QP:j9Ir5yOxiIlrfspjqwRLT

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\README.e26f79ad.TXT

Family

darkside

Ransom Note

----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/ZPHGS4V186LJE9D41BZPQYMAVTRO61FS5DFITXN3164U5B607T7W51NEY0WV7CT1 When you open our website, put the following data in the input form: Key: jKdQRGN9mNfPP8E6f3cjkmyokpCOSXS2DnnFGEKzzUjydeJi0Y5Jwuo50cdYDeB721Qp70mHSyWcbZxtet9CL8rddRLMXV1VCor8siYPCido4knletpYGAywiyiJ6eVCeAfy21AqvcHudVyb3M7DgwYdaA7B5P3fwZkx4VmRMKn9pKP0Eethj7HsMgIC2Y3HlLGdOQT9s7bLhnLqaUrDpQ2DewShszE6NmgsWEGPQNGP7u1BOGw27hyNaH9gZV97RtPQ4PGkNdUAXopYgWbLcU5S4o4q4FdBglJsBaAtRYqE6q9lBVJhU44PdWQn7sLxr2FArxbtmaMEEfCqWstqY1naLzqnIDz7EDpPlXVbZcwGRXA9Hx42hIYVG434ppADhJV5GIyxm0boe3Sr0etwsdGvV0grUSfDez0HdBW3PpY3e7r2xiCZGEJOsNxZ7v2l5BMHZFNjyafb7BJ22v3mvvpJd3uVJPeItuGlC5sNYy0zvY9zWdMQVqD3i2l2pvi2fEKJ0ettXVghy5bjcKrGusT9FouoT7scmknYh7tVnb8zccnPxZSEt39 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!

URLs

http://darksidfqzcuhtk2.onion/ZPHGS4V186LJE9D41BZPQYMAVTRO61FS5DFITXN3164U5B607T7W51NEY0WV7CT1

Targets

- Target
  
  00ca7e42b298d5e2a06050b527abef40_NeikiAnalytics.exe
- Size
  
  259KB
- MD5
  
  00ca7e42b298d5e2a06050b527abef40
- SHA1
  
  b343760bff3f0c6adbd9b5b39e65894be6d550a5
- SHA256
  
  6183d9296b128c378e32228916ec2d34fc1cee19b84bcdcf6ff8dcb2e6492a42
- SHA512
  
  6e24df07d15b1dbe3da753aa6730685729490285d83397e7f140c592a45d1ecdb33c7cbd15c48bd3c4f803cff55c655f86d7523187a770a434f85f795dcba4c6
- SSDEEP
  
  6144:j9Iuq5yqBxgxIlrfImRCW2cqv7pLR1N1e9ORXrP4QP:j9Ir5yOxiIlrfspjqwRLT
Score

10^/10

darkside ransomware spyware stealer
- DarkSide
  Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
  ransomware darkside
- Renames multiple (146) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2