lockfile

General

Target

a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0
Size

250KB
Sample

210922-p2c8ksfbhj
MD5

ef37842fc159631f9dd8f94c5e05a674
SHA1

07e19dd6f2b5ebe86614251860a067012d2a0ce9
SHA256

a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0
SHA512

e45235cea10568547a0cf9b3c3d5550eb76a67ebd950dad17bbd4fb1e441c9f904e7c6c0e268e1a8a8d6374de229bd0f096f4b45983febf6237987823ced00a4

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\LOCKFILE-README.hta

Family

lockfile

Ransom Note

LOCK FILE Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: contact us qTox ID: B2F873769EB6B508EBC2103DDEB7366CEFB7B09AB8314DAD0C4346169072686690489B47EAEB https://tox.chat/download.html Email: [email protected] Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion This link only works in Tor Browser! Follow the instructions on this page Do not try to recover files yourself. this process can damage your data and recovery will become impossible Do not rename encrypted files. Do not waste time trying to find the solution on the Internet. The longer you wait, the higher will become the decryption key price Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Thanks to the warning wallpaper provided by lockbit, it's easy to use

Emails

[email protected]

URLs

https://tox.chat/download.html

http://zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion

Targets

- Target
  
  a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0
- Size
  
  250KB
- MD5
  
  ef37842fc159631f9dd8f94c5e05a674
- SHA1
  
  07e19dd6f2b5ebe86614251860a067012d2a0ce9
- SHA256
  
  a926fe9fc32e645bdde9656470c7cd005b21590cda222f72daf854de9ffc4fe0
- SHA512
  
  e45235cea10568547a0cf9b3c3d5550eb76a67ebd950dad17bbd4fb1e441c9f904e7c6c0e268e1a8a8d6374de229bd0f096f4b45983febf6237987823ced00a4
Score

10^/10

lockfile ransomware spyware stealer
- LockFile
  LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
  ransomware lockfile
- Drops file in Drivers directory
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
- Drops startup file
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops file in System32 directory
behavioral1 behavioral2