Extracted

Extracted

• • Target
    2024-10-06_e09dd7cca0c6c147ba21b4062e723c5b_darkside
  • Size 146KB
  • SHA256 d9938ac4346d03a07f8ce8b57436e75ba5e936372b9bfd0386f18f6d56902c88
  • MD5 e09dd7cca0c6c147ba21b4062e723c5b
  • SHA1 ff6333bdda824e4c13bcd13351bd4bb14aaeab11
  • SHA512 603f45dc0b3302739ef6e4727572ecf64cf6f65c80af1e05aa3795fc9ce36849cf0f465bbf8a9f116c8fb3da8d91998ec5582b24503f4f43764e7b3543a94c4e
  • SSDEEP 3072:yqJogYkcSNm9V7DNDgSKet5JXglKso1WT:yq2kc4m9tDjlrJX3so
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryransomwarespywarestealer

  • Renames multiple (325) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2