Extracted

• • Target
    sub_06cfe7f5d88e.bin
  • Size 59KB
  • SHA256 06cfe7f5d88e82f7adda6d8333ca8b302debb22904c68a942188be5730e9b3c8
  • MD5 91e2807955c5004f13006ff795cb803c
  • SHA1 a3e7561de73378b453186a6c33858bf47577d69c
  • SHA512 5d98bc32af83462938633c0d2b692d5b69c9c6151459aefc1276d41947e2514c444ed417c19b39b9c5b8d5359dee5fa2d3f7c8c30ae9f2a687cd02ec3a7b6311
  • SSDEEP 768:vjjmbIax7F3DS4/S9+CuUSbVAdNcxGV1yln/pY23W58:0x7Fu4/ihrhDTV1yl/SZ58
  • TLSH
    T167434D3D33E1D1BBEE640EB42D8D3B7382592F7139629D1BC2541E64A6B4D379A2700B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (147) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2