Extracted

• • Target

    LisectAVT_2403002C_159.exe

  • Size

    75KB

  • MD5

    82eab016732be7b8b8aa14f205ca69cf

  • SHA1

    818f451044610b1805e4c515d2bf112718fc8125

  • SHA256

    c2ee523bb90260218b88e7fe0b7ca0dee8c9042c863682619c542d4961ddb32e

  • SHA512

    1b87a7b81c1841e6dff89224f386ff52bd752e124e8c1c68e480ba399446404ad29e92172731fccd93e8a89e61f5097c07c9d6e0f41d2131a96d317344343eea

  • SSDEEP

    1536:Dx7Fu4/i6/P3rlckx5+R4VDZ5CRGCq2iW7z:F7FujwPblhx1DZ5yGCH

  Score

  10^/10

  darksideaspackv2credential_accessdefense_evasiondiscoveryexecutionransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Renames multiple (160) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2