Pulse Detail — Threat Intelligence

PULSE NAME

MAR-10337802-1.v1: DarkSide Ransomware

WHITE AlienVault 2021-07-09 Modified: 2021-08-08

IOCs

LOW VOLUME

The Department of Homeland Security (DHS) is distributing a Malware Analysis Report (AR21-189A) on behalf of the US government's Cybersecurity and Infrastructure Security Agency (CISA).

darkside ransomware

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1490 T1082 T1486 T1485 T1001 T1041

MALWARE FAMILIES

DarkSide

Indicators of Compromise (9)

All domain FileHash-MD5 FileHash-SHA1 FileHash-SHA256

TYPE	INDICATOR	DESCRIPTION	CREATED
domain	baroquetees.com	—	2021-07-09
FileHash-MD5	f587adbd83ff3f4d2985453cd45c7ab1	MD5 of 2715340f82426f840cf7e460f53a36fc3aad52aa	2021-07-09
FileHash-SHA1	2715340f82426f840cf7e460f53a36fc3aad52aa	—	2021-07-09
FileHash-SHA256	156335b95ba216456f1ac0894b7b9d6ad95404ac7df447940f21646ca0090673	SHA256 of 2715340f82426f840cf7e460f53a36fc3aad52aa	2021-07-09
FileHash-SHA1	4d03e3db39adaf57df53181429706aa854878026	—	2021-07-09
FileHash-SHA256	3ba456cafcb31e0710626170c3565aae305bc7c32a948a54f0331d0939e0fe8a	—	2021-07-09
FileHash-SHA256	f6fba207c71d1f53f82d96a87c25c4fa3c020dca58d9b8a266137f33597a0b0e	—	2021-07-09
domain	dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion	—	2021-07-09
domain	rumahsia.com	Registered=04/27/2020 Registrar=NAMECHEAP INC NS=dns1.registrar-servers.com	2021-07-09

References (1)

↗ https://us-cert.cisa.gov/ncas/analysis-reports/ar21-189a