Extracted

• • Target
    sub_43e61519be44.bin
  • Size 59KB
  • SHA256 43e61519be440115eeaa3738a0e4aa4bb3c8ac5f9bdfce1a896db17a374eb8aa
  • MD5 f9fc1a1a95d5723c140c2a8effc93722
  • SHA1 ce2480dec2ee0a47549fad355c3cf154f9aab836
  • SHA512 3816029ac654cfc546e78c5f331ad61ef21ebab0e92bacdba5a5d2cd9149002930cf46c9a1dab357697540849229d2fc0a490433aa95713d36685334ce8e8b11
  • SSDEEP 768:9jjV7Iax7F3DS4/S9F+YeYf+tB1tJq5c2yGHMwY23W5:vx7Fu4/iF5eTtJq1sLZ5
  • TLSH
    T11F433B7C33D1D1BBEE610AB55E4837B293886F7239665C0683682E24A2F0D27CB67517
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (147) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2