General
-
Target
2024-06-27_9d321df9405cb926068b683c6523ea33_darkside
-
Size
152KB
-
Sample
240627-pyj7qasbkb
-
MD5
9d321df9405cb926068b683c6523ea33
-
SHA1
d97e101eb8cad867de03bce0034a8a3792924360
-
SHA256
12474618f58fb808fe514e68e7e686185a9d512e469463f331bcde823e997596
-
SHA512
ac45f36a2f2107ebae5974bad12eacb5d4a65ed0d116d1a8d677a1d305e76d5bfebf4af006c75b2186eeb000c91201c04877a536b01215307a3be3ac2af110b7
-
SSDEEP
3072:j6glyuxE4GsUPnliByocWepwiFD78XS9hkEfYL:j6gDBGpvEByocWeyi6XS9hX
Behavioral task
behavioral1
Sample
2024-06-27_9d321df9405cb926068b683c6523ea33_darkside.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-06-27_9d321df9405cb926068b683c6523ea33_darkside.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
C:\FSx0EaYuE.README.txt
https://radar.ltd/contact-us
http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us
https://cybertube.video
https://cybernewsint.com
https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L
https://socradar.io/dark-web-profile-dispossessor-ransomware/
https://x.com/ransomfeednews/status/1793647035888840759
https://alvac.es
https://vimeo.com/752214614
https://hacknotice.com/2022/10/01/alvac-sa/
https://twitter.com/elhackernet/status/1576678217603502080
https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live
https://t.me/elconfidencial
https://t.me/baseleak
https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md
Extracted
C:\FSx0EaYuE.README.txt
https://radar.ltd/contact-us
http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us
https://cybertube.video
https://cybernewsint.com
https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L
https://socradar.io/dark-web-profile-dispossessor-ransomware/
https://x.com/ransomfeednews/status/1793647035888840759
https://alvac.es
https://vimeo.com/752214614
https://hacknotice.com/2022/10/01/alvac-sa/
https://twitter.com/elhackernet/status/1576678217603502080
https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live
https://t.me/elconfidencial
https://t.me/baseleak
https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md
Targets
-
-
Target
2024-06-27_9d321df9405cb926068b683c6523ea33_darkside
-
Size
152KB
-
MD5
9d321df9405cb926068b683c6523ea33
-
SHA1
d97e101eb8cad867de03bce0034a8a3792924360
-
SHA256
12474618f58fb808fe514e68e7e686185a9d512e469463f331bcde823e997596
-
SHA512
ac45f36a2f2107ebae5974bad12eacb5d4a65ed0d116d1a8d677a1d305e76d5bfebf4af006c75b2186eeb000c91201c04877a536b01215307a3be3ac2af110b7
-
SSDEEP
3072:j6glyuxE4GsUPnliByocWepwiFD78XS9hkEfYL:j6gDBGpvEByocWeyi6XS9hX
Score10/10-
Renames multiple (362) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-