Extracted

• • Target
    sub_bac2149254f5.bin
  • Size 59KB
  • SHA256 bac2149254f5ce314bab830f574e16c9d67e81985329619841431034c31646e0
  • MD5 c2764be55336f83a59aa0f63a0b36732
  • SHA1 0bfc26e7a035a143339516b877ac11eefbbeefb5
  • SHA512 9c413793996c48c4c9e092e8c09810712c84dc64288515b64acc7108671071283e8dc4b3d782befd9cbf04bd0db0fb61c8986b429eec5b748722910455d399fa
  • SSDEEP 768:Qbj6iIq6oSqww3/T8K5UWCTxdCCDSbVrdNcxGV1yl+84v8RZc:s6VqwwvAKa/TxoCODTV1yl+84v8RZ
  • TLSH
    T1F6435B3D11E0C1B7FEA00AF52D8A36B3825D7F713E41990B86A05F98A5B4C67DA2714F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (137) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2