General
-
Target
19022025_0655_sample.exe
-
Size
62KB
-
Sample
250219-hpn1zszmex
-
MD5
bf41fc54f96d0106d34f1c48827006e4
-
SHA1
cb998d02179f514a537f660046f5014f587fadd8
-
SHA256
1b9d3728a2c489d4166e8752525c88cf532db6409cf1147d6955ab4302c89b48
-
SHA512
d061cb6d31a4dab3aaefb7334347566d7678a48fd16d8db5e7ba55142884d50822b4e5877b5de8a14550f125aba13a947514aa789104aac9c538bbd865ea5b54
-
SSDEEP
1536:Ncw2LbyC+HX4fWEsAWyuAlfV/0Hjpl0PMRmIPT1c/ebioQ+Cf:ND5fHo+9ZyPRViL0PwPof
Static task
static1
Behavioral task
behavioral1
Sample
19022025_0655_sample.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
19022025_0655_sample.exe
Resource
win10v2004-20250217-en
Malware Config
Extracted
C:\Users\Admin\Contacts\README.8746624d.TXT
darkside
http://darksidedxcftmqa.onion/blog/article/id/6/dQDclB_6Kg-c-6fJesONyHoaKh9BtI8j9Wkw2inG8O72jWaOcKbrxMWbPfKrUbHC
http://darksidfqzcuhtk2.onion/K71D6P88YTX04R3ISCJZHMD5IYV55V9247QHJY0HJYUXX68H2P05XPRIR5SP2U68
Targets
-
-
Target
19022025_0655_sample.exe
-
Size
62KB
-
MD5
bf41fc54f96d0106d34f1c48827006e4
-
SHA1
cb998d02179f514a537f660046f5014f587fadd8
-
SHA256
1b9d3728a2c489d4166e8752525c88cf532db6409cf1147d6955ab4302c89b48
-
SHA512
d061cb6d31a4dab3aaefb7334347566d7678a48fd16d8db5e7ba55142884d50822b4e5877b5de8a14550f125aba13a947514aa789104aac9c538bbd865ea5b54
-
SSDEEP
1536:Ncw2LbyC+HX4fWEsAWyuAlfV/0Hjpl0PMRmIPT1c/ebioQ+Cf:ND5fHo+9ZyPRViL0PwPof
-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Darkside family
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1