Extracted

• • Target
    sub_afb22b1ff281.bin
  • Size 59KB
  • SHA256 afb22b1ff281c085b60052831ead0a0ed300fac0160f87851dacc67d4e158178
  • MD5 f75ba194742c978239da2892061ba1b4
  • SHA1 c43ee0cef6acee7d503f056764abc64d8f7ae9b9
  • SHA512 56c2cc3d3fea0aeb370e44f473e3c48c939b64d6ce98de5b26d4d67cb5b94c3391e5e9c87546dd551f90d0f5e26e520e00958346eaa9d7e2f89cb6a174a86d96
  • SSDEEP 768:Qbj6iIq6oSqww3/T8K5UWCTxdCCDSbVrdNcxGV1yljOix3c:s6VqwwvAKa/TxoCODTV1yljOO
  • TLSH
    T1BA435B3D11E0D1B7FEA00AF52D8A36B3824D7F713E41991B86A05F9CA1B4C679A1718F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (157) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2