Extracted

• • Target
    4098b54c9d27b00ce34d04ffac24213ed28993a2854827851b157d63407c2e4e.exe
  • Size 5.9MB
  • SHA256 4098b54c9d27b00ce34d04ffac24213ed28993a2854827851b157d63407c2e4e
  • MD5 794c5aa1b0e1f9cf2fc7fe5f22117c3f
  • SHA1 1821fe210298b1d22b25f1a544abcfe092999ff7
  • SHA512 28c186359035e3f4bc5b4f0420c1e72de5e16fc3fa3b8d41316dd59739c552c810e180feff4637f25696f59b291b7cc00d66d969a4e7d2f460ec4471b1ad83cf
  • SSDEEP 98304:psCGaED3PF1pAJsqh8rltswCN6N7hqts6G5WWLF3/EDhRKYmKH7dEpuo5jv59Ndr:pMjbpKsZXCNntspWK3/EDLtp7dRopvXP
  • TLSH
    T1C156337366A10099E1D4CD314637FEB571F60B6F8E42B8B85186ACC13A278F6E313697
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealervmprotect

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (168) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2