lockbit

General

Target

ec6992702eb2666e3bab7c50b8cb504176a2e50340be944de03d2134255b6317
Size

629KB
Sample

220316-1f2jtsggg7
MD5

902bc738cdd4e05d92a0661d8e962b50
SHA1

10e8ab02ed6ac267791bea58941141170041877f
SHA256

ec6992702eb2666e3bab7c50b8cb504176a2e50340be944de03d2134255b6317
SHA512

57d46c90469c4e5fe290bd4ff00c41266cb592774a262517e2e31cdc57f8323b6725034ba11d4d12564e4bcf9619a633bfb8ba86078f82b22b877e270a868b79

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9BBCAA9F80E8F93BC | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9BBCAA9F80E8F93BC This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9BBCAA9F80E8F93BC

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9BBCAA9F80E8F93BC

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note

Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9BBCAA9F80E8F93BC Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9BBCAA9F80E8F93BC This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9BBCAA9F80E8F93BC

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9BBCAA9F80E8F93BC

Extracted

Path

C:\odt\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9CB0FA46B92552ECC | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9CB0FA46B92552ECC This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9CB0FA46B92552ECC

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9CB0FA46B92552ECC

Targets

- Target
  
  ec6992702eb2666e3bab7c50b8cb504176a2e50340be944de03d2134255b6317
- Size
  
  629KB
- MD5
  
  902bc738cdd4e05d92a0661d8e962b50
- SHA1
  
  10e8ab02ed6ac267791bea58941141170041877f
- SHA256
  
  ec6992702eb2666e3bab7c50b8cb504176a2e50340be944de03d2134255b6317
- SHA512
  
  57d46c90469c4e5fe290bd4ff00c41266cb592774a262517e2e31cdc57f8323b6725034ba11d4d12564e4bcf9619a633bfb8ba86078f82b22b877e270a868b79
Score

10^/10

lockbit evasion persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2