Extracted

• • Target
    sub_d43b271fb493.bin
  • Size 60KB
  • SHA256 d43b271fb4931263f8fa54b297e3cf60762a0fe5c50ed76999f276dcc3c283be
  • MD5 b9d04060842f71d1a8f3444316dc1843
  • SHA1 7e01305dd52b6c92d97e88c870410381577cad61
  • SHA512 4bf62dbbd5dfe4682cb78b4f751a8b2f10e769ecf0bcbd81cd292fe0c7c54307ed728cf8b5b408b0a8d4cf90111bbe027130011f92161c3e687ffb37bc70fb34
  • SSDEEP 768:TTjagICPhDt3bS4nyz9lGg9w6XkwLNnxNHNhZwo4qi5WvrHY23W5o:BpDtG4nM9e6XrLvpN7jx8Z5
  • TLSH
    T1BC534B2D33E1D1BBFE210EB91E4937B393996F7238265D07C3642E5862A0D379A63117
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (118) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2