General

  • Target

    2024-07-10_dce3f6e158f2b52da18c994cd8a2ab3a_darkside

  • Size

    145KB

  • Sample

    240710-3st2mayhnh

  • MD5

    dce3f6e158f2b52da18c994cd8a2ab3a

  • SHA1

    55f3794996bfede256110c5b21b885727c865e4d

  • SHA256

    b47c02aacbc56df31a533706f45afa945600f1a7d2b3ed8831cef0581104c177

  • SHA512

    2b9484bc41ed41cc33e5cbf11451f4c7f9f2c49ff7066d3e9a1c1eadc69488ce53fcb52bde2aac190d1db38a023b3426724bfb11c440d2c94d84048e92a070af

  • SSDEEP

    3072:PqJogYkcSNm9V7DqOyY4lX7u1f8CNixMKT:Pq2kc4m9tDtK

Malware Config

Targets

    • Target

      2024-07-10_dce3f6e158f2b52da18c994cd8a2ab3a_darkside

    • Size

      145KB

    • MD5

      dce3f6e158f2b52da18c994cd8a2ab3a

    • SHA1

      55f3794996bfede256110c5b21b885727c865e4d

    • SHA256

      b47c02aacbc56df31a533706f45afa945600f1a7d2b3ed8831cef0581104c177

    • SHA512

      2b9484bc41ed41cc33e5cbf11451f4c7f9f2c49ff7066d3e9a1c1eadc69488ce53fcb52bde2aac190d1db38a023b3426724bfb11c440d2c94d84048e92a070af

    • SSDEEP

      3072:PqJogYkcSNm9V7DqOyY4lX7u1f8CNixMKT:Pq2kc4m9tDtK

    • Renames multiple (364) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks