Extracted

• • Target

    Trojan-Ransom.Win32.Darkside.m-243dff06fc80a049f4fb37292f8b8def0fce29768f345c88ee10699e22b0ae60.7z

  • Size

    27KB

  • MD5

    bc9a60e3d4259018a83f0344031734ed

  • SHA1

    0e739230d538fed4efc4b4074cb67f6e363220db

  • SHA256

    9eab4fb5f7a8336fe681cda5be1c8d443f248d7592022d248d2524eec9cdfdda

  • SHA512

    6f641879ca22ca82bdb989c35beb29556987f089e244cadc7f399fb0a0d4de83b7194afbf85b27f140c7334e47f4aaa32b1d2e437b2c21321698536bfaee1957

  • SSDEEP

    768:FE5N8GlaEDa2u+ncyIfX9Z4G+Vf/XssQDH4GN:FE5NFwEDabPwP8P4GN

  Score

  10^/10

  darksidecredential_accessdiscoveryexecutionransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Darkside family

    darkside

  • Renames multiple (140) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1