darkside-main.zip
- SHA256 8f89ead036fde496467f1ce100b27948d5a72aa316f645dcc79d5cfc739164b6
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acer.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.dll
Resource
win10v2004-20250314-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target darkside-main.zip
- Size 129KB
- Sample250407-e4519syvgt
- SHA256 8f89ead036fde496467f1ce100b27948d5a72aa316f645dcc79d5cfc739164b6
- MD5 ede38b854967e345b5098a682fe34543
- SHA1 49979a7dc343d6b9a4446f9b62b622d8b4cfef74
- SHA512 a634b119741f80e9da1e2e5c659546a566e3a7f55e92c8521d747011c841672568eeeb852aee6f647a2534c05049dc03c15083f3a51520cebb5a064ba85afee4
- SSDEEP 3072:xOBsdXL4Xo42LtWEcAXJSFc0nUxu5Erik0aW9MaG8xEQOnx:xOC5IMNP590euzFPG8xEQ+
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack002/acer.exe unpack003/151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe unpack004/156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.dll unpack005/8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
File Explorer
-
darkside-main.zip.zip 129KB
-
darkside-main/.DS_Store6KB
-
darkside-main/0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9.zip.zip 32KB
-
acer.exe.exe 56KB
-
darkside-main/151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.zip.zip 31KB
-
151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe.exe 59KB
-
darkside-main/156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.zip.zip 32KB
-
156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.dll.dll 54KB
-
darkside-main/8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.zip.zip 31KB
-
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe.exe 59KB
-
darkside-main/README.md2KB
darkside-main/.DS_Store
- SHA256 9e389cce5ae5379ffbfd413286fbc39d43b2bdb1d12767458c4b633ec4dae9f2
- MD5 34431c269e9f69dd02c6f84fc4287404
- SHA1 a2c43d41947fb43939a48abd041d70bae386425e
- SHA512 347438e71372d6e1242765b2b48489006b7a8008920d391cee7f5b45e50e5072c07682017530ccc3e6f39c53874d3c4a0c63ce9a8a15b05f86b320e6775bc482
- SSDEEP 12:QiwPH8zY8TYZK9EEX/HnXw6XAERqXw6X:fjtrfnVMV
- MD5 SHA1 SHA512 SSDEEP
darkside-main/0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9.zip
- SHA256 23244f1a10efd5c452432abce1e998c09b8bb5b56afbade932f24c59e9d5bf04
- MD5 36f7a0ba7055ad89a76cccb1019ce2d9
- SHA1 4e86f8e7a47535a3f417ab9acaea553e0425b950
- SHA512 d2c35c6d2fc45d177275a2653666c8fa4af2e6d6d52469649e38b5ba07d08599ac9acafdde3cb254b34a749dc32f88ad33eb0de776f9e0236820436f4cdcb020
- SSDEEP 768:xo6dP0Q0OaPB6jPKedXGUTyD2UfBX6MQTECyRI4PIo:xzJOBkdXLTEXNTm4H
- MD5 SHA1 SHA512 SSDEEP
Password
infected
acer.exe
- IMPHASH d7eea11ae47ec0d735ecd47e54de8af5
- SHA256 0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9
- MD5 979692cd7fc638beea6e9d68c752f360
- SHA1 c511ae4d80aaa281c610190aa13630de61ca714c
- SHA512 d7b7b6a968e6d7b7f3e7f98decb6b331b08122e491bf0b0dbe243223fb177218a758c34830f20c47f2a799acdd146297ec7f930c2bb4d5c6830ce65c8274ea6d
- SSDEEP 768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLd9kvAx0:g4HHerjZX7pLjJKjSO5i
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
45757
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
ntdll
NtWriteVirtualMemory
NtReadVirtualMemory
Name
.text
Size
37KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text1
Size
1024B
Virtual Size
736B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
darkside-main/151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.zip
- SHA256 65973ba1a7483de1f4f9b69458e820de950cea7dd8253f5a9adebbee6447c367
- MD5 b57c47e3adb9b581585d2ee838ad8212
- SHA1 77a57121d2598228ff508a2e720eaf4117d2a654
- SHA512 fa184c29c976224636d03a1f8e41762b7a69499c152ac1af0933f9d00947b048a5c09f302cad1add8e5a32e2d7f5f8318ec63488dc3345313f9de751972aa0bd
- SSDEEP 768:OGVKR4VqiuVjTjaA9Tt//aYhvdff5vgS4ikJQ4A2ON:hLtuB/B/PdX5vv5LfHN
- MD5 SHA1 SHA512 SSDEEP
Password
infected
151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe
- IMPHASH 17a4bd9c95f2898add97f309fc6f9bcd
- SHA256 151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5
- MD5 9d418ecc0f3bf45029263b0944236884
- SHA1 eeb28144f39b275ee1ec008859e80f215710dc57
- SHA512 82ced42a32f18ede4358459e08bed1adff85d49c952aca7a086571c5b71fd8b3185ea4306abd1f4e639a12f11161f43c73bf6049d76902d365c5a5e4c7e71f3d
- SSDEEP 768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvD7Y23W58:0x7Fu4/ihrhDTV1ylbcZ58
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33205
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryA
ExitProcess
Name
.text
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
374B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
darkside-main/156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.zip
- SHA256 c02026fa1c485d96350e2a53b6306abd6cdfd93e28bdcf47c8419586372c2046
- MD5 347234a33741bd0331725a3cd5f10f5f
- SHA1 973b6f38e632f0ae85b7f15f551a702fe12fab5e
- SHA512 00fcac559d732261d1bcad433a707d2bfbd58ab8783a84caa1a501e0b8254763d4585444086b4135540609afa22d9456462adc936bad04839bfaa01f387f1bf1
- SSDEEP 768:YU+o2vJ6L0nAjxoYOP+3j6bwy5paK/k1Xn/+Z4U:Y7vY0nUx/dY5E0kl/iJ
- MD5 SHA1 SHA512 SSDEEP
Password
infected
156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.dll
- IMPHASH 6c8408bb5d7d5a5b75b9314f94e68763
- SHA256 156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673
- MD5 f587adbd83ff3f4d2985453cd45c7ab1
- SHA1 2715340f82426f840cf7e460f53a36fc3aad52aa
- SHA512 37acf3c7a0b52421b4b33b14e5707497cfc52e57322ad9ffac87d0551220afc202d4c0987460d295077b9ee681fac2021bbfdebdc52c829b5f998ce7ac2d1efe
- SSDEEP 768:u2v9Ij6f3J8OT1PMK30DbQDH2doyomHRL83M4/NShWxEs0l29SFd2Xyj09rLd:fmET1PMK3qbpHY3M4wWmXgSFTSrLd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
45752
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text1
Size
1024B
Virtual Size
795B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
446B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
darkside-main/8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.zip
- SHA256 9afd3a27d61810af2bd40b20663c0ca72d95741f2960b793141b23c3af1afa82
- MD5 66c83a95825bcb4c79a320fc0f5ffa60
- SHA1 32e3a44dc248b08700bfa345548e4b2315bc51f8
- SHA512 412368f78f52f21c71f233e9f18093a70d952b6daa542aa3bf7b4300fd7b6e7e349fb7c65b56573e9652203ba109c4bb7f0d3f8db524a0b3304e45eb1333425d
- SSDEEP 768:Bt9SjOwAbQVC1M1usyOdvd2ZPdwolvxAGqg4FQG0MKTOYiiOG:BPSjOws9M10Gd2XxWGDj0G
- MD5 SHA1 SHA512 SSDEEP
Password
infected
8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe
- IMPHASH 17a4bd9c95f2898add97f309fc6f9bcd
- SHA256 8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc
- MD5 04fde4340cc79cd9e61340d4c1e8ddfb
- SHA1 88fc623483f7ffe57f986ed10789e6723083fcd8
- SHA512 105ddfb8bbfedc8460fb1e6d26c6cd02ea81bfdc12a196c1c2f8e52bc73faf03a688339b4c231ab5b5b3885f2ad248115c32c95fc64e84462a16c3e237e6fc9c
- SSDEEP 768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1yldoZrY23W5o:BpDtG4nMpboDTV1ylVZ5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
33297
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryA
ExitProcess
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
374B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
darkside-main/README.md
- SHA256 d06f6534d40d6ceeffbe3ca4697f5c1fc98799165b8335ce6a2e591a3c5f5a4c
- MD5 adb4ea960063378678c85b28367f2abc
- SHA1 3644366c6ad57514b7af43f1c4e47ae89eb71806
- SHA512 f30dbe440e72ba0b4626b030f360ff41618881e61061513fe838203c9596787e6ed03eb8e5ece57e86518fd8102e1617a9c5cef60d7d2e593a6b7acd641b1470
- MD5 SHA1 SHA512