General
-
Target
2024-07-10_96e3e3d9ebe4d58cd95eb228435fb963_darkside
-
Size
145KB
-
Sample
240710-3ry9ysyhje
-
MD5
96e3e3d9ebe4d58cd95eb228435fb963
-
SHA1
abdc64e951191b76aca54288c7f8fa73815e3595
-
SHA256
59df766d70769ab099af2c4baddef908b86df1052251f0e1dfb62ac7d1eea91a
-
SHA512
b6c1e815b54bafd5f23b3141e7fadfe6577f2b860afe9116a26cae9a125ec4367a30aac82680241c672a824e53b4b8afdae361d14360dbed1bef71cecfae592f
-
SSDEEP
3072:+qJogYkcSNm9V7Dt1IGupuEE5MuJHkyT:+q2kc4m9tD4Gua5k
Behavioral task
behavioral1
Sample
2024-07-10_96e3e3d9ebe4d58cd95eb228435fb963_darkside.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-10_96e3e3d9ebe4d58cd95eb228435fb963_darkside.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
2024-07-10_96e3e3d9ebe4d58cd95eb228435fb963_darkside
-
Size
145KB
-
MD5
96e3e3d9ebe4d58cd95eb228435fb963
-
SHA1
abdc64e951191b76aca54288c7f8fa73815e3595
-
SHA256
59df766d70769ab099af2c4baddef908b86df1052251f0e1dfb62ac7d1eea91a
-
SHA512
b6c1e815b54bafd5f23b3141e7fadfe6577f2b860afe9116a26cae9a125ec4367a30aac82680241c672a824e53b4b8afdae361d14360dbed1bef71cecfae592f
-
SSDEEP
3072:+qJogYkcSNm9V7Dt1IGupuEE5MuJHkyT:+q2kc4m9tD4Gua5k
Score9/10-
Renames multiple (352) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-