lockbit

General

Target

0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.zip
Size

55KB
Sample

200619-wq72cs2sqx
MD5

c6a6b956f14f13df9aa62b2fda1e4cf8
SHA1

6e84b32c802fe7614e8a551f8774389697c52528
SHA256

8a550acacdbc1bf387189702f686a6b78d5fe08286f99165f4dee4cf7ce4b662
SHA512

feee25e80a7f9cecd51b2854a4980a529d0c23d2b9ab4614f21ff33b63b04d325c4a7d26540390333f875cbf1177c12f32f87f078143fdb236bdc717e46413b3

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBCEB996649AC036A0 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our) # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBCEB996649AC036A0

Extracted

Path

C:\odt\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBBA0A23576F9C683E This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our) # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBBA0A23576F9C683E

Targets

- Target
  
  Lockbit.bin
- Size
  
  101KB
- MD5
  
  889328e2cf5f5d74531b9b0a25c1871c
- SHA1
  
  d14a6e699a1f0805bd1248c80c2dc9dfccf0f403
- SHA256
  
  0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f
- SHA512
  
  f14ed75d97d2cd7e351f3cf75f9f374c2e9e388a1f5855a478d50b098b1250a67e375bdbd193b24d00bc052e0b3f8018cb3e74760be8c40b860be9f3d0ba2493
Score

10^/10

ransomware evasion lockbit persistence
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Deletes system backup catalog
  Ransomware often tries to delete backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Deletes itself
- Adds Run entry to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies service
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2