Extracted

• • Target

    2025-01-21_95327cd72707256460a62f54aafb35d0_darkside

  • Size

    148KB

  • MD5

    95327cd72707256460a62f54aafb35d0

  • SHA1

    b70ca69207f2efe3da247a8c88996b732d6c72a9

  • SHA256

    6efed93758e3a905ccc68f75e2c01fff4e16b95325801b7576f640e1992f550e

  • SHA512

    7f4b30575e0cc1352453681a546dd2148219942779f09fb7b85afa43fb7938a7aa36f6d7a1bdd4510ad4442a156ebe4602d2dd50754da021f9698bcd68045331

  • SSDEEP

    3072:f6glyuxE4GsUPnliByocWepFWGvh+gZqVoqe:f6gDBGpvEByocWeNvh+RoZ

  Score

  10^/10

  defense_evasiondiscoveryransomwarespywarestealer

  • Renames multiple (8016) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2