Extracted

• • Target
    sub_fb76b4a667c6.bin
  • Size 59KB
  • SHA256 fb76b4a667c6d790c39fcc93a3aac8cd2a224f0eb9ece4ecfd7825f606c2a8b6
  • MD5 29bcd459f5ddeeefad26fc098304e786
  • SHA1 076d0d8d07368ef680aeb0c08f7f2e624c46cbc5
  • SHA512 a2e909957023851c8a0d74c9a658b16e0c0efaf39497ecabd9775ce37381c0e2207c4158786dd37ef0dd6e99523e6994f95248216593750107b67f62f7a0bce0
  • SSDEEP 768:TTjagICPhDt3bS4nyz2CuwSbV5dNcxGV1ylQ+IxGY23W5ot:BpDtG4nMpboDTV1ylnIfZ5i
  • TLSH
    T1C5535D3D73E1D1B7EE600EB41D893BB382896F3239629D0BC2542F58A6B0D375A27507
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (131) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2