Extracted

• • Target

    2024-12-13_107d3c9b830ddd884f3ca5761e777f9b_darkside

  • Size

    148KB

  • MD5

    107d3c9b830ddd884f3ca5761e777f9b

  • SHA1

    36c6830e16f46d00e16431175b31f3565aa5b4c8

  • SHA256

    bc20b30abf15d6374ef9094a49f0875b53c154a0fcb3ae6e054d678091208f70

  • SHA512

    7a061b642955fc1775e0cec5b4f4deef4e22ad0ceeed4b15c948c3f1fbf42c166554c71212a3c874b8a0177a255f1da6b64af4225d0de99e7d87ccd598c3ecb3

  • SSDEEP

    3072:46glyuxE4GsUPnliByocWepCnkOry1yC8Nwt:46gDBGpvEByocWeSkOmC

  Score

  10^/10

  defense_evasiondiscoveryransomwarespywarestealer

  • Renames multiple (8043) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2