874a51dcd456d3dd2f731df7ac4fa484ed2a15393b704c7364d7664cca043adf

General

Target
target.ps1
Size 13KB
Sample260822-1vtgrszdlb
SHA256 874a51dcd456d3dd2f731df7ac4fa484ed2a15393b704c7364d7664cca043adf
MD5 a3000b3b6e1ba238bdcf0f3c97ad600a
SHA1 d7c1e00b3a4015902ec1a792d0918f5f284010db
SHA512 f8b79cec45d837e8229192948ed9201cb66f61ba9d256569b1eb45189ead269ff1c249673de7f80fa3837d5706db47f9826a8439d29f8493badd49d4c644f2a2
SSDEEP 384:idBDR4GVeDUvfXAoSkRgRjRQrZ1q037OwTl:+htfXRCtQtzzTl
TLSH
T11652C5623A9A791142334F75E47BE78DFA15003BA6130804349CD1D5CFB9B6BC7AAF88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
https://discord.com/api/webhooks/1540672809456500787/I20jLDhANRttGSTqISRPIqT4MPk7YRcEPDnW_PSbitbQNQEsoAml6mFHX7hA3WupjN33

Extracted

Path

C:\Users\Admin\Desktop\DARKSIDE_README.html

Ransom Note

â˜ DARKSIDE RANSOMWARE â˜ YOUR FILES HAVE BEEN ENCRYPTED WITH AES-256 Victim ID: CFOSH9CAPSOSTFEV TO RECOVER YOUR FILES: Send 0.05 BTC to: bc1qc9maqr4h932vcj7utg8d6m3xxxv6vjn30uwagh Visit: https://freedom.wisp.uno/?id=CFOSH9CAPSOSTFEV âš WARNING: Do NOT attempt decryption manually! Support: [email protected]

Emails

[email protected]

URLs

https://freedom.wisp.uno/?id=CFOSH9CAPSOSTFEV

Extracted

Path

C:\Users\Admin\Desktop\DARKSIDE_README.html

Ransom Note

DARKSIDE RANSOMWARE YOUR FILES HAVE BEEN ENCRYPTED WITH AES-256 Victim ID: TO RECOVER YOUR FILES: Send 0.05 BTC to: Visit: https://freedom.wisp.uno/?id=UGSNKMF0SYJCAEED WARNING: Do NOT attempt decryption manually! Support: [email protected]

Emails

[email protected]

URLs

https://freedom.wisp.uno/?id=UGSNKMF0SYJCAEED

Extracted

Path

C:\Users\Admin\Desktop\DARKSIDE_README.html

Ransom Note

DARKSIDE RANSOMWARE YOUR FILES HAVE BEEN ENCRYPTED WITH AES-256 Victim ID: TO RECOVER YOUR FILES: Send 0.05 BTC to: Visit: https://freedom.wisp.uno/?id=CQLG7G1N7F20NYXZ WARNING: Do NOT attempt decryption manually! Support: [email protected]

Emails

[email protected]

URLs

https://freedom.wisp.uno/?id=CQLG7G1N7F20NYXZ

Targets

- Target
  target.ps1
- Size 13KB
- SHA256 874a51dcd456d3dd2f731df7ac4fa484ed2a15393b704c7364d7664cca043adf
- MD5 a3000b3b6e1ba238bdcf0f3c97ad600a
- SHA1 d7c1e00b3a4015902ec1a792d0918f5f284010db
- SHA512 f8b79cec45d837e8229192948ed9201cb66f61ba9d256569b1eb45189ead269ff1c249673de7f80fa3837d5706db47f9826a8439d29f8493badd49d4c644f2a2
- SSDEEP 384:idBDR4GVeDUvfXAoSkRgRjRQrZ1q037OwTl:+htfXRCtQtzzTl
- TLSH
  T11652C5623A9A791142334F75E47BE78DFA15003BA6130804349CD1D5CFB9B6BC7AAF88
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2