General
-
Target
Darkside Bahaa.zip
-
Size
33KB
-
Sample
240604-2d2mgsec97
-
MD5
7616c32b9c1bac6ca93d2dabaebb7747
-
SHA1
1553584c8e201ee3d04ad376408585c7c271a018
-
SHA256
653e076b154b3a70afba1234d3cde5479af8317fbcc4a92f2887f264ac29e690
-
SHA512
b9dd78644ac560b76d42b5e3d88ea82602f96f626c14fb38ca3174a7e58621e06b90cb159218d96e196d7676788ba71bab9df78d42ef93e127b9c0382272c424
-
SSDEEP
768:7NvUEvpTWN0yUbFGGyi4HAsK5EKSIQosDyh2bZVUt3WqRgc7M0yTpQb:vxTWN0yidt5OIFsGgXUt3W+1I0cQb
Static task
static1
Behavioral task
behavioral1
Sample
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\Recovery\README.4f60b97d.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Targets
-
-
Target
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
-
Size
56KB
-
MD5
3f2cb535fc5bc296aa5b0d2897c265d0
-
SHA1
c30358563fa940eb5cd6064d4d16defee43b0310
-
SHA256
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
-
SHA512
6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2
-
SSDEEP
768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLC9kvAx0:g4HHerjZX7pLjJKjSO+i
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (140) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-