Extracted

Extracted

Extracted

Extracted

• • Target

    ddn/BDDarkSideDecryptor.exe

  • Size

    9.5MB

  • MD5

    cb1b67988c63e6e951be00b3eda7f74f

  • SHA1

    049fff52f877516a756c6333d12b3c1c1cfbe519

  • SHA256

    1a72fe563f588580440da34a03b1af3ba072e66404608c521b4adbcb034a33f6

  • SHA512

    ef1d74da565026fef631f83dee70fafb661bea74cad69b70035f10700b733f64ce34b3308c0fee59222d1eb0767b87672f1f824ea923008c70a3e8be229ff289

  • SSDEEP

    196608:IdJEHHWtwPlARRmtejsum3/DBekLV58IzN6+ZR62Wi:IbEn9PlAGMivDdjxNF762W

  Score

  4^/10

  discovery
  behavioral1

• • Target

    acer.exe

  • Size

    56KB

  • MD5

    979692cd7fc638beea6e9d68c752f360

  • SHA1

    c511ae4d80aaa281c610190aa13630de61ca714c

  • SHA256

    0a0c225f0e5ee941a79f2b7701f1285e4975a2859eb4d025d96d9e366e81abb9

  • SHA512

    d7b7b6a968e6d7b7f3e7f98decb6b331b08122e491bf0b0dbe243223fb177218a758c34830f20c47f2a799acdd146297ec7f930c2bb4d5c6830ce65c8274ea6d

  • SSDEEP

    768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLd9kvAx0:g4HHerjZX7pLjJKjSO5i

  Score

  10^/10

  darksidediscoveryransomware

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Darkside family

    darkside

  • Renames multiple (153) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral2

• • Target

    151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5.exe

  • Size

    59KB

  • MD5

    9d418ecc0f3bf45029263b0944236884

  • SHA1

    eeb28144f39b275ee1ec008859e80f215710dc57

  • SHA256

    151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5

  • SHA512

    82ced42a32f18ede4358459e08bed1adff85d49c952aca7a086571c5b71fd8b3185ea4306abd1f4e639a12f11161f43c73bf6049d76902d365c5a5e4c7e71f3d

  • SSDEEP

    768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1ylvD7Y23W58:0x7Fu4/ihrhDTV1ylbcZ58

  Score

  10^/10

  darksidecredential_accessdefense_evasiondiscoveryexecutionransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Darkside family

    darkside

  • Renames multiple (139) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3

• • Target

    156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673.dll

  • Size

    54KB

  • MD5

    f587adbd83ff3f4d2985453cd45c7ab1

  • SHA1

    2715340f82426f840cf7e460f53a36fc3aad52aa

  • SHA256

    156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673

  • SHA512

    37acf3c7a0b52421b4b33b14e5707497cfc52e57322ad9ffac87d0551220afc202d4c0987460d295077b9ee681fac2021bbfdebdc52c829b5f998ce7ac2d1efe

  • SSDEEP

    768:u2v9Ij6f3J8OT1PMK30DbQDH2doyomHRL83M4/NShWxEs0l29SFd2Xyj09rLd:fmET1PMK3qbpHY3M4wWmXgSFTSrLd

  Score

  10^/10

  darksidediscoveryransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Darkside family

    darkside

  • Blocklisted process makes network request

  • Drops startup file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral4

• • Target

    8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc.exe

  • Size

    59KB

  • MD5

    04fde4340cc79cd9e61340d4c1e8ddfb

  • SHA1

    88fc623483f7ffe57f986ed10789e6723083fcd8

  • SHA256

    8cfd28911878af048fb96b6cc0b9da770542576d5c2b20b193c3cfc4bde4d3bc

  • SHA512

    105ddfb8bbfedc8460fb1e6d26c6cd02ea81bfdc12a196c1c2f8e52bc73faf03a688339b4c231ab5b5b3885f2ad248115c32c95fc64e84462a16c3e237e6fc9c

  • SSDEEP

    768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1yldoZrY23W5o:BpDtG4nMpboDTV1ylVZ5

  Score

  10^/10

  darksidecredential_accessdiscoveryexecutionransomwarespywarestealer

  • DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Darkside family

    darkside

  • Renames multiple (139) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral5