lockbit

General

Target

6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852
Size

627KB
Sample

220316-jkb2asafc8
MD5

1234951c81c9f0950d7ebccf5c0da425
SHA1

c51df34b23cc7bfdf58ebdc21df84deab9688f8d
SHA256

6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852
SHA512

e69fa50b6ff651c2bb916e715e5100946c0be58e78e5867a56345383d0128b25da7a81d8dfa97aef7961f6e2ec1e74b4af903f4b10671face36f3c9cfaf50236

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9B9F589BED020CFC6 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9B9F589BED020CFC6 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9B9F589BED020CFC6

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9B9F589BED020CFC6

Extracted

Path

C:\odt\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9A886E1A75F23774D | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9A886E1A75F23774D This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9A886E1A75F23774D

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9A886E1A75F23774D

Targets

- Target
  
  6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852
- Size
  
  627KB
- MD5
  
  1234951c81c9f0950d7ebccf5c0da425
- SHA1
  
  c51df34b23cc7bfdf58ebdc21df84deab9688f8d
- SHA256
  
  6edbd520e23625af5f8074103ccbb1c27d3919d2f40fc202bdae8b1e71397852
- SHA512
  
  e69fa50b6ff651c2bb916e715e5100946c0be58e78e5867a56345383d0128b25da7a81d8dfa97aef7961f6e2ec1e74b4af903f4b10671face36f3c9cfaf50236
Score

10^/10

lockbit persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2