Darkside Ransomware v1.8.6.2 - Reverse Engineering Analysis

Key facts for DarkSide ransomware reverse engineering

Detection coverage for DarkSide ransomware reverse engineering

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5281 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Darkside Ransomware Shadow Copy Deletion via PowerShell/WMI Win32_Shadowcopy

Detects PowerShell, pwsh or wmic invoking Win32_Shadowcopy with a Delete/Remove-WmiObject action, the exact command Darkside v1.8.6.2 runs (hex-encoded in the binary) on 64-bit hosts to destroy Volume Shadow Copies before encryption. Behaviour-first: fires on the WMI shadow-copy deletion regardless of sample hash or C2 domain.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1490, T1059.001, T1047
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wmic.exe") CommandLine="*Win32_Shadowcopy*" (CommandLine="*Delete*" OR CommandLine="*Remove-WmiObject*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_line values(ParentImage) as parent_image by host User Image
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S"), detection="TL-2026-5281 Darkside Win32_Shadowcopy deletion"

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "wmic.exe")
| where ProcessCommandLine has "Win32_Shadowcopy" and ProcessCommandLine has_any ("Delete", "Remove-WmiObject")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256

Sigma

title: Darkside Ransomware Shadow Copy Deletion via Win32_Shadowcopy
id: 5b1f2c6e-3a47-4d0e-9c1a-7e2d8f4b6a01
status: experimental
description: Detects PowerShell or WMIC deleting Volume Shadow Copies through the Win32_Shadowcopy WMI class, as done by Darkside v1.8.6.2 on 64-bit hosts
references:
    - https://www.chuongdong.com/reverse%20engineering/2021/05/06/DarksideRansomware/
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-131a
    - https://intel.threadlinqs.com/threats/TL-2026-5281
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.impact
    - attack.t1490
    - attack.execution
    - attack.t1059.001
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wmic.exe'
    selection_class:
        CommandLine|contains: 'Win32_Shadowcopy'
    selection_action:
        CommandLine|contains:
            - 'Delete'
            - 'Remove-WmiObject'
    condition: all of selection_*
falsepositives:
    - Backup or storage administration scripts that prune shadow copies
    - Disk-cleanup tooling run by IT
level: high

Known false positives:

• Backup/storage admin scripts that prune old shadow copies via WMI
• Disk-cleanup or imaging tools run by IT staff

Tuning notes: Allow-list known backup-admin hosts/accounts and signed maintenance scripts. If PowerShell is launched with -EncodedCommand (the sample stores the command hex-encoded), pair with Script Block Logging (EventCode 4104) searching for Win32_Shadowcopy. Raise to auto-containment when the parent is an unsigned binary in a user-writable path.

• 🔒 Darkside Mass Stop of Backup, VSS, SQL and Security Services · unlock with TL Creds
• 🔒 Darkside Ransom Note README<hex>.TXT Created Across Many Directories · unlock with TL Creds
• 🔒 Darkside Affiliate Tooling: Mimikatz and BloodHound/SharpHound Execution · unlock with TL Creds
• 🔒 Darkside Self-Deletion via cmd.exe /C DEL /F /Q >> NUL · unlock with TL Creds
• 🔒 Darkside Termination of Database, Backup and Office Processes · unlock with TL Creds
• 🔒 Cobalt Strike Default Named Pipes Used by DarkSide Affiliates · unlock with TL Creds
• 🔒 Darkside ICMLuaUtil (CMSTPLUA) COM Elevation UAC Bypass · unlock with TL Creds
• 🔒 Darkside C2 Domains, Onion Address and Community-Observed Sibling Infrastructure · unlock with TL Creds

Indicators of compromise for DarkSide ransomware reverse engineering

As of 2026-11-05, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-5281.

Sample indicators (3 of 15)

• Domain: securebestapp20[.]com
• File hash: 9d418ecc0f3bf45029263b0944236884
• Domain: temisleyes[.]com

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

How DarkSide ransomware reverse engineering works

Darkside is a ransomware-as-a-service (RaaS) family whose affiliates encrypt and steal data from large, high-revenue organizations. This record documents the v1.8.6.2 32-bit Windows sample (MD5 9d418ecc0f3bf45029263b0944236884, SHA256 151fbd6c299e734f7853497bd083abfa29f8c186a9db31dbe330ace2d35660d5) as reverse engineered by an independent researcher on 2021-05-06.

Configuration and obfuscation: the sample resolves its libraries and APIs dynamically from an encrypted name table, decrypts all strings with a XOR KEY_BUFFER derived from two hard-coded 16-byte keys, and wipes the resolved API array from memory after use. The embedded configuration holds the RSA-1024 exponent (0x0-0x7F) and modulus (0x80-0x103) followed by aPLib-compressed JSON-style flags, terminated with a 0xDEADBEEF marker. Flags observed: ENCRYPTION_MODE Full, UAC elevation enabled, shadow-copy deletion enabled, self-delete enabled, ransom note enabled, logging disabled. The configuration also carries the process and service kill lists, excluded file extensions and directories, the 32-byte victim ID and the C2 URLs.

Execution flow: the malware calls GetUserDefaultLangID and GetSystemDefaultUILanguage and exits immediately on Russian-language systems. It creates a mutex named Global\<CRC32 of the file contents>. It checks IsUserAnAdmin and token information; when unprivileged it bypasses UAC by calling CoGetObject with the moniker Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} (the ICMLuaUtil interface, backed by cmstplua.dll) and invoking ShellExec. It then enables privileges with AdjustTokenPrivileges and impersonates logged-on tokens. On 64-bit hosts it runs a hex-encoded PowerShell command, Get-WmiObject Win32_Shadowcopy | ForEach-Object {$_.Delete();}; on 32-bit hosts it queries SELECT * FROM Win32_ShadowCopy through IWbemLocator/IWbemServices. It enumerates services with the Service Control Manager and stops or deletes those matching the kill list (vss, sql, svc$, memtas, mepocs, sophos, veeam, backup, GxVss, GxBlr, GxFWD, GxCVD, GxCIMgr), and terminates processes such as sql, oracle, ocssd, dbsnmp, agntsvc, excel, outlook, winword, powerpnt, msaccess, thunderbird and firefox, while sparing vmcompute.exe, vmms.exe, vmwp.exe, svchost.exe, TeamViewer.exe and explorer.exe.

Encryption: files are encrypted with Salsa20 using a random 64-byte matrix generated with RtlRandomEx; the matrix is encrypted with the custom RSA-1024 key and appended to each file as a 0x90-byte blob (0x80-byte encrypted matrix plus a 0x10-byte CRC32 block) that doubles as the already-encrypted marker. Traversal is a single-threaded depth-first walk feeding I/O-completion-port worker threads, which the analysis says causes thread starvation compared with Babuk or Conti. Many system extensions and directories are skipped (for example exe, dll, sys, lnk, windows, program files, programdata, tor browser). The recycle bin is enumerated, and network shares and hosts are discovered with NetShareEnum, GetAdaptersInfo, SendARP and gethostbyaddr. Command-line parameters: -path <directory> encrypts a directory, and a bare filename encrypts a single file. The ransom note is named README<GUID checksum>.TXT.

C2 and cleanup: on port 443 the sample POSTs victim details (username, hostname, domain, OS version, architecture, disk information) to securebestapp20.com and temisleyes.com using a Firefox/80.0 user agent, in the format random_num1=hash(info)&random_num2=victim_UID, and later reports encrypted file counts, bytes encrypted, skipped files and elapsed time. It then self-deletes with CMD.EXE /C DEL /F /Q <short path> >> NUL. The hunt data also lists the onion address darksidfqzcuhtk2.onion.

Broader context from public reporting: the CISA/FBI alert AA21-131A (2021-05-11) covered the DarkSide attack on Colonial Pipeline. Reporting describes affiliate initial access through brute-force attacks, spam campaigns, purchased credentials and vulnerable RDWeb/RDP/Citrix, post-exploitation with Cobalt Strike, Metasploit, Mimikatz and BloodHound, and living-off-the-land activity. The source article itself provides no CVEs, no CVSS score and no actor attribution.

MITRE ATT&CK techniques by tactic:

Discovery

T1007 System Service Discovery; T1018 Remote System Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1135 Network Share Discovery; T1614.001 System Location Discovery: System Language Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails

Execution

T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1106 Native API

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Privilege Escalation

T1134.001 Access Token Manipulation: Token Impersonation/Theft; T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Remediation for DarkSide ransomware reverse engineering

Immediate actions

• Block securebestapp20.com and temisleyes.com at DNS and egress proxies; block outbound Tor traffic
• Hunt for Global\<CRC32> mutexes, README*.TXT ransom notes and files carrying the 0x90-byte trailer
• Alert on Get-WmiObject Win32_Shadowcopy deletion and on CoGetObject Elevation:Administrator moniker use with CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
• Isolate hosts that stop vss, sql, veeam, backup or Sophos services in rapid succession

Workarounds

• Set UAC to Always Notify and remove local administrator rights from standard users
• Restrict PowerShell and WMI use to administrative accounts

Longer-term hardening

• Maintain offline, immutable backups and test restores
• Enforce MFA on RDP, RDWeb and Citrix and restrict external remote access
• Segment networks and limit SMB share exposure
• Deploy EDR with behavioral ransomware detection and tamper protection for backup and security services

Affected and fixed versions

• Microsoft — Windows (32-bit payload; 64-bit and 32-bit hosts handled)
  Vulnerable versions: Windows systems with UAC enabled and local user not elevated

Timeline of DarkSide ransomware reverse engineering

• 2020-08-10 locked-ioc-14 ransomware begins operations in August 2020 with targeted attacks against organizations, per Trend Micro reporting
• 2020-11-01 locked-ioc-14 establishes its ransomware-as-a-service model in November 2020, recruiting affiliates and later operating a data leak site
• 2021-05-06 Independent researcher publishes a reverse-engineering analysis of locked-ioc-14 ransomware v1.8.6.2 (MD5 locked-ioc-4) covering encryption, UAC bypass, shadow-copy deletion and C2 behavior
• 2021-05-07 locked-ioc-14 ransomware attack on Colonial Pipeline, a U.S. Gulf Coast critical-infrastructure operator, later detailed by CISA and the FBI
• 2021-05-11 Security vendors and news outlets (Infoblox, Splunk, Security Affairs) publish advisories on locked-ioc-14 TTPs: RDP/Citrix/RDWeb access, locked-ioc-9, locked-ioc-15, Salsa20 plus RSA-1024 encryption
• 2021-05-11 CISA and the FBI publish alert AA21-131A on locked-ioc-14 ransomware, describing the Colonial Pipeline attack and affiliate TTPs
• 2021-06-07 U.S. Justice Department announces recovery of about 63.7 bitcoin (roughly $2.3 million) of the approximately 75 bitcoin ransom Colonial Pipeline paid to locked-ioc-14
• 2021-07-01 BlackMatter emerges in July 2021, widely assessed as a locked-ioc-14 successor, and shuts down in November 2021 citing law enforcement pressure
• 2026-11-04 Threat tracked on the Threadlinqs platform as TL-2026-5281 from the 2021-05-06 reverse-engineering analysis and public reporting

Sources cited for DarkSide ransomware reverse engineering

• CISA/FBI Alert AA21-131A: DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks CISA · Government advisory · 2021-05-11
• Darkside Ransomware (v1.8.6.2 reverse engineering) chuongdong.com · Research · 2021-05-06
• Cyber Threat Advisory: DarkSide Ransomware Attack on Colonial Pipeline infoblox.com · Vendor report
• The DarkSide of the Ransomware Pipeline splunk.com · Vendor report
• What We Know About DarkSide Ransomware and the US Pipeline Attack (Trend Micro) Trend Micro · Vendor report · 2021-05-12
• US CISA and FBI publish joint alert on DarkSide ransomware securityaffairs.com · News · 2021-05-11
• DOJ recovers $2.3 mln of Colonial Pipeline's ransom news.yahoo.com · News · 2021-06-07
• BlackMatter ransomware gang is shutting down due to pressure from law enforcement securityaffairs.com · News · 2021-11-03

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Previous and next in ransomware

• MountLocker Ransomware v5.0 (XingLocker / Astro Locker) - Worm-Capable RSA-2048/ChaCha20 Locker: Reverse Engineering Analysis Previous report
• PLAY Ransomware (PlayCrypt) - Reverse Engineering Analysis and Big Game Hunting Operations Next report