Overview

overview

10

Static

static

lock.exe

windows7_x64

10

lock.exe

windows10_x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    lock.exe

  • Size

    2.2MB

  • Sample

    211113-q61ecafag6

  • MD5

    fc93ecb882fbc1bac46aaf4232ce9b66

  • SHA1

    e4cfd33fc8f20f05b07299845268a54dd33ffced

  • SHA256

    7f65f443d129dcfc59b3c2a001b5a1f3cda092b3008e62a73ab87ba8f782b215

  • SHA512

    2fffaf9f8c2305be7c55bc23b8822dab5ce961332833e0bffbb6cbbee01f97907e4b5b4e573b682f66b5309d462302e1db7df0f6df3b34dccaf323357dc2efca

Score
10/10
ransomwarespywarestealer

Malware Config

Extracted

Path

\??\c:\users\Admin\Desktop\readme.txt

Ransom Note
ALL OF YOUR FILES HAVE BEEN ENCRYPTED !!!!! [+] Whats Happen? [+] Your files are now encrypted, and currently unavailable. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER) and it will be LEAKED. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in out interests. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have only one ways: 1) [RECOMMENDED] Using TOR Bundle! a) Download and run TOR Windows Bundle from this site: https://www.torproject.org/download/tor/ b) Download any irc software that supports socks proxy (e.g HexChat c) Setup tor proxy for irc software ( default host: 127.0.0.1 port 9050 d) Add http://y2cyumvhavcecc6kr5tpat5gdnz2lsw5ucjxbv7s2ggxsh7gj57omuyd.onion/6667 to your network list e) Set your nickname to nick@hostname f) Connect and join #support channel 2) If TOR blocked in your country, try to use VPN and try 1) HERE IS YOUR USERID:f76621de-24cd-4ecf-bfc4-560beeff6fbc Send it to us for decryption [*] If you don't receive a response, wait a while and resend it. [*]
URLs

http://y2cyumvhavcecc6kr5tpat5gdnz2lsw5ucjxbv7s2ggxsh7gj57omuyd.onion/6667

Targets

    • Target

      lock.exe

    • Size

      2.2MB

    • MD5

      fc93ecb882fbc1bac46aaf4232ce9b66

    • SHA1

      e4cfd33fc8f20f05b07299845268a54dd33ffced

    • SHA256

      7f65f443d129dcfc59b3c2a001b5a1f3cda092b3008e62a73ab87ba8f782b215

    • SHA512

      2fffaf9f8c2305be7c55bc23b8822dab5ce961332833e0bffbb6cbbee01f97907e4b5b4e573b682f66b5309d462302e1db7df0f6df3b34dccaf323357dc2efca

    Score
    10/10
    ransomwarespywarestealer

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks