- Home
- Detectable Ransomware
- DarkSide
Ransomware Research
DarkSide Ransomware
DarkSide is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on August 1, 2020, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- DarkSide
- First Seen
- August 1, 2020
How DarkSide Ransomware Works
File Encryption Patterns
DarkSide modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
./\.[0-9a-f]{8}$/
Ransom Note and Payment Demands
After encrypting files, DarkSide displays ransom notes demanding payment for file recovery:
/^README\.[0-9a-f]{8}.TXT$/
Ransom message:
notes/README.1d673a7f.TXT
Note locations:
EveryFolder
Ransom message:
notes/d0f4572a.png
Note locations:
Desktop
Technical Indicators
Associated Executable Files
The following executable files are associated with DarkSide ransomware:
TZXG9esW.exe
acer.exe
8nk8SUWm.exe
ut.exe
dark_side12.exe
RDZQKMaygacTXDgnBZrnamh.exe
GrkkupZg.exe
idfoodsf.exe
WtrA3YYo.exe
dsfds.exe
UVyqsfEZ.exe
2.exe
calimalimodumator.exe
MicSwitch.exe
dark_side28.exe
3Opi9pp1.exe
Darkside.exe
EMOTET.exe
homie.exe
partmgr.sys
sample2.exe
aF8OQuGk.exe
mokster_encryptor.exe
Elastio Can Help You
Don't let DarkSide ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This DarkSide ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like DarkSide.
Last updated: September 30, 2025
Recent Ransomware
Explore other threats in our database