General
-
Target
2024-12-31_f24ce79d82b9bf5196870d70b397c885_darkside
-
Size
150KB
-
Sample
241231-mhw58sylgk
-
MD5
f24ce79d82b9bf5196870d70b397c885
-
SHA1
d12defeab969c6e033b043b7061d85aab68cd165
-
SHA256
635c74ec2d6f50ddab0a1ee3a28fa54b459b73efb5af47993a99714beaecfbc3
-
SHA512
b54b5df4343309fc8cc75bc4038b49e1cb409d7a0f4ac2676f4e5636575c9cbb8412aa25f01db1404031ce910f654e324daaa06b17eddb60f9dfae9e24009bd8
-
SSDEEP
3072:F6glyuxE4GsUPnliByocWepHHPUwTAyeM+Sr/:F6gDBGpvEByocWeNHfTA0x/
Behavioral task
behavioral1
Sample
2024-12-31_f24ce79d82b9bf5196870d70b397c885_darkside.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-31_f24ce79d82b9bf5196870d70b397c885_darkside.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\8bTDEWLVO.README.txt
Targets
-
-
Target
2024-12-31_f24ce79d82b9bf5196870d70b397c885_darkside
-
Size
150KB
-
MD5
f24ce79d82b9bf5196870d70b397c885
-
SHA1
d12defeab969c6e033b043b7061d85aab68cd165
-
SHA256
635c74ec2d6f50ddab0a1ee3a28fa54b459b73efb5af47993a99714beaecfbc3
-
SHA512
b54b5df4343309fc8cc75bc4038b49e1cb409d7a0f4ac2676f4e5636575c9cbb8412aa25f01db1404031ce910f654e324daaa06b17eddb60f9dfae9e24009bd8
-
SSDEEP
3072:F6glyuxE4GsUPnliByocWepHHPUwTAyeM+Sr/:F6gDBGpvEByocWeNHfTA0x/
Score10/10-
Renames multiple (343) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-