Extracted

• • Target
    sub_691515a485b0.bin
  • Size 59KB
  • SHA256 691515a485b0b3989fb71c6807e640eeec1a0e30d90500db6414035d942f70a5
  • MD5 e44450150e8683a0addd5c686cd4d202
  • SHA1 8c482a0eed33c8a4542c3cb2715a242f2259343d
  • SHA512 7d65d22ad630fd77c50e277a44fdcc46fa86235c93524f9751ac9ddf0ce19261707fab631108fc908a71029900dbf6ada119d607edfadc3ce309f86a9c3765fe
  • SSDEEP 768:Qbj6iIq6oSqww3/T8K5UWCTxdCCDSbVrdNcxGV1ylwPhpuc:s6VqwwvAKa/TxoCODTV1ylEc
  • TLSH
    T199435B3D51E0C1B7FEA00AF52D8A36B3825C7F713E41990B86A06F98A170C67DA5718F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (154) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2