General
-
Target
darkside-main.zip
-
Size
129KB
-
Sample
250407-eznw7aytdx
-
MD5
ede38b854967e345b5098a682fe34543
-
SHA1
49979a7dc343d6b9a4446f9b62b622d8b4cfef74
-
SHA256
8f89ead036fde496467f1ce100b27948d5a72aa316f645dcc79d5cfc739164b6
-
SHA512
a634b119741f80e9da1e2e5c659546a566e3a7f55e92c8521d747011c841672568eeeb852aee6f647a2534c05049dc03c15083f3a51520cebb5a064ba85afee4
-
SSDEEP
3072:xOBsdXL4Xo42LtWEcAXJSFc0nUxu5Erik0aW9MaG8xEQOnx:xOC5IMNP590euzFPG8xEQ+
Static task
static1
Behavioral task
behavioral1
Sample
acer.exe
Resource
win11-20250313-en
Malware Config
Extracted
C:\45b378cfa389121d62932bc9d4e6\README.091144a6.TXT
darkside
http://darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion/162/thedixiegroup/LCfyHRcwffrYTblpZvoPO3XDbrYPcNu0wVAsH5p49LSjBfzTmtdXT48azXFlMu7q
http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/W57MRI9C7YZJUZEABBBYRQLSUTG22JZ9MAH0WT1ISHC405KP7Z2UWY3AI3J68DNM
Targets
-
-
Target
acer.exe
-
Size
56KB
-
MD5
979692cd7fc638beea6e9d68c752f360
-
SHA1
c511ae4d80aaa281c610190aa13630de61ca714c
-
SHA256
0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9
-
SHA512
d7b7b6a968e6d7b7f3e7f98decb6b331b08122e491bf0b0dbe243223fb177218a758c34830f20c47f2a799acdd146297ec7f930c2bb4d5c6830ce65c8274ea6d
-
SSDEEP
768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLd9kvAx0:g4HHerjZX7pLjJKjSO5i
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Darkside family
-
Renames multiple (163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-