MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4098b54c9d27b00ce34d04ffac24213ed28993a2854827851b157d63407c2e4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkSide


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4098b54c9d27b00ce34d04ffac24213ed28993a2854827851b157d63407c2e4e
SHA3-384 hash: 63bfbef1c2fbc72429bddf87f8d1ad74584e1811104615c3c4dee562d1d00954389bf04498ed73f8d1e29bec8a2de6c3
SHA1 hash: 1821fe210298b1d22b25f1a544abcfe092999ff7
MD5 hash: 794c5aa1b0e1f9cf2fc7fe5f22117c3f
humanhash: coffee-seven-angel-four
File name:794c5aa1_by_Libranalysis
Download: download sample
Signature DarkSide
Create hunting rule
File size:6'157'824 bytes
First seen:2021-05-13 10:04:21 UTC
Last seen:2021-05-13 10:44:10 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 58435290dcc75b122641951f08ff6c21 (1 x DarkSide)
ssdeep 98304:psCGaED3PF1pAJsqh8rltswCN6N7hqts6G5WWLF3/EDhRKYmKH7dEpuo5jv59Ndr:pMjbpKsZXCNntspWK3/EDLtp7dRopvXP
Threatray 1 similar samples on MalwareBazaar
TLSH C156337366A10099E1D4CD314637FEB571F60B6F8E42B8B85186ACC13A278F6E313697
Reporter Libranalysis
Tags:DarkSide


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
2
# of downloads :
339
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
explorer .exe
Verdict:
Malicious activity
Analysis date:
2021-05-13 09:51:18 UTC
Tags:
ransomware darkside trojan
Link:
https://app.any.run/tasks/54e1e32a-b2fc-4106-a6ea-4526fd5f602e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/156084/
Detection(s):
SecuriteInfo.com.Mal.VMProtBad-A.6923.313.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a window
DNS request
Connection attempt
Sending a UDP request
Launching a process
Using the Windows Management Instrumentation requests
Launching a service
Creating a file in the Windows subdirectories
Changing a file
Adding an access-denied ACE
Creating a file in the mass storage device
Forced shutdown of a browser
Encrypting user's files
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
DarkSide
Create hunting rule
Detection:
malicious
Classification:
rans.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/780850
Signature
Antivirus / Scanner detection for submitted sample
Bypasses PowerShell execution policy
Detected VMProtect packer
Found ransom note / readme
Found Tor onion address
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Obfuscated command line found
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected DarkSide Ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4098b54c9d27b00ce34d04ffac24213ed28993a2854827851b157d63407c2e4e/
Threat name:
Win32.Ransomware.DarkSide
Create hunting rule
Status:
Malicious
First seen:
2021-05-13 10:05:20 UTC
File Type:
PE (Exe)
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=icmlkte5e6yazy2nat72yjbbh3jite5cqvecpbi3cv6wgqd4fzha._file
Verdict:
unknown
Similar samples:
84783081ade87f5a4a1902a275eb66c7fe8ebef9e43cdd2d4527bdb1a5a51f04
DarkSide
Result
Malware family:
darkside
Create hunting rule
Score:
  10/10
Tags:
family:darkside ransomware spyware stealer vmprotect
Link:
https://tria.ge/reports/210513-5ff8nw8ss6/
Behaviour
Modifies Control Panel
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Sets desktop wallpaper using registry
Deletes itself
Reads user/profile data of web browsers
Modifies extensions of user files
VMProtect packed file
DarkSide
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/156084/

Comments