Extracted

• • Target
    sub_0839aabe5fd6.bin
  • Size 59KB
  • SHA256 0839aabe5fd63b16844a27b3c586c02a044d119010a1a40ee4035501c34eae0d
  • MD5 885fc8fb590b899c1db7b42fe83dddc3
  • SHA1 c104056f9a926d27a2082f0510c97b09cb0eb3e5
  • SHA512 2b8e49ad84434dcaf98635120ac54bfa7e55bb61bf9d0e3f1f25ab81e950f638311d2121217bf5840834778d5e137551e24b89da02f12dc6be99d755c54f4c13
  • SSDEEP 768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yl3XsY23W58:0x7Fu4/ihrhDTV1ylHXZ58
  • TLSH
    T164435D3D33E1D1BBEE640AB51D8D3B7382996F3139629D17C2641F64A2B0D379A2740B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (131) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2