Extracted

• • Target

    a48af4ad3eddc63e3c079a43fd3b45d5fa66fe22c78f32f97285c428d1f1f774

  • Size

    166KB

  • MD5

    be1c18efa764b1b32421b6beb57cd3e9

  • SHA1

    9fff40b4653ab368e04e398d9c54a1aa3a320d49

  • SHA256

    a48af4ad3eddc63e3c079a43fd3b45d5fa66fe22c78f32f97285c428d1f1f774

  • SHA512

    f35e3f123f4b0378626de52035390d2b8c9cf42f5b1882c66d8a79c58cd798a89506fb402a93a7ceaba1078226d7eba80e9c8a93321fc0a17e4e012fc8b15824

  • SSDEEP

    3072:o/0Lu+FKdYM69P6padn/DDonc8oOgajAnPvNHwcW0m1QTj:o/d+FKdYMQPrdn/HovAnlwx0cC

  Score

  10^/10

  darksidecredential_accessdiscoveryexecutionransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Renames multiple (172) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2