lockbit

General

Target

0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.sample
Size

101KB
Sample

210726-xj4y3ja14a
MD5

889328e2cf5f5d74531b9b0a25c1871c
SHA1

d14a6e699a1f0805bd1248c80c2dc9dfccf0f403
SHA256

0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f
SHA512

f14ed75d97d2cd7e351f3cf75f9f374c2e9e388a1f5855a478d50b098b1250a67e375bdbd193b24d00bc052e0b3f8018cb3e74760be8c40b860be9f3d0ba2493

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBA1AA33BD82C41D84 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our) # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBA1AA33BD82C41D84

Extracted

Path

C:\odt\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBDD2363781C3C4EE2 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our) # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbitks2tvnmwk.onion/?D0407AC9D97C78CBDD2363781C3C4EE2

Targets

- Target
  
  0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.sample
- Size
  
  101KB
- MD5
  
  889328e2cf5f5d74531b9b0a25c1871c
- SHA1
  
  d14a6e699a1f0805bd1248c80c2dc9dfccf0f403
- SHA256
  
  0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f
- SHA512
  
  f14ed75d97d2cd7e351f3cf75f9f374c2e9e388a1f5855a478d50b098b1250a67e375bdbd193b24d00bc052e0b3f8018cb3e74760be8c40b860be9f3d0ba2493
Score

10^/10

lockbit evasion persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2