Extracted

• • Target
    2026-08-21_201cb3b2d172408aa0c67472535c1250_darkside_elex
  • Size 59KB
  • SHA256 c0dae1b466ecfa26d2dc6f7bb7ad6ba7766e0e659f611b570a8c5330433aa84e
  • MD5 201cb3b2d172408aa0c67472535c1250
  • SHA1 89635604105587b829b00788f5f5c1e91621816e
  • SHA512 1a86ac37fc862494d26b4b0c6e68e4782a49e90704ce7e83d85e7435a3faddd81734166058b716c251bfdb17773dca044ceb115c3455dfee1dc8ecaf4c10ee78
  • SSDEEP 768:5jjmbIax7F3DS4/S9FCuUSbVAdNcxGV1ylCtIdtY23W58:ix7Fu4/igrhDTV1ylMZ58
  • TLSH
    T151434C3D33E1D1BBEE640EB51D893B7382996F3239629D07C2541F64A2B4D379A2700B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutiondarksideransomwarespywarestealer

  • Family: DarkSide

    Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.

    ransomwaredarkside

  • Renames multiple (129) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2