General
-
Target
2024-09-29_8911139e0686509cbf44954ba2ba6675_darkside
-
Size
150KB
-
Sample
240929-d2v8lsybmq
-
MD5
8911139e0686509cbf44954ba2ba6675
-
SHA1
f16aad9a562b1de55e33b2de23abaa7eb0a4a5c7
-
SHA256
4f395d7d4d5c2578f957070e4b0acc6d4bc2d0761f39258e990f2070bd3db2fc
-
SHA512
d20a28ac9987409dfb450740f904138e7ffb5ce16cb7ae13b29061b990136e472cef56427e35a337d07d100e6a6c3ddf08c82a6d402f97c468b73ad8c2d4f6a1
-
SSDEEP
3072:AqJogYkcSNm9V7D5KbhIJ+2EE9ZzoZmT:Aq2kc4m9tD5KmJ0EnMZ
Behavioral task
behavioral1
Sample
2024-09-29_8911139e0686509cbf44954ba2ba6675_darkside.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-29_8911139e0686509cbf44954ba2ba6675_darkside.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\tMAXi4m5p.README.txt
Targets
-
-
Target
2024-09-29_8911139e0686509cbf44954ba2ba6675_darkside
-
Size
150KB
-
MD5
8911139e0686509cbf44954ba2ba6675
-
SHA1
f16aad9a562b1de55e33b2de23abaa7eb0a4a5c7
-
SHA256
4f395d7d4d5c2578f957070e4b0acc6d4bc2d0761f39258e990f2070bd3db2fc
-
SHA512
d20a28ac9987409dfb450740f904138e7ffb5ce16cb7ae13b29061b990136e472cef56427e35a337d07d100e6a6c3ddf08c82a6d402f97c468b73ad8c2d4f6a1
-
SSDEEP
3072:AqJogYkcSNm9V7D5KbhIJ+2EE9ZzoZmT:Aq2kc4m9tD5KmJ0EnMZ
Score10/10-
Renames multiple (299) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-