lockbit

General

Target

c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d
Size

445KB
Sample

220418-n5mqrahga6
MD5

1a7eb7fc0b6c28388e1f1e3beab03892
SHA1

0fdbdc0e8aa192f245ce68888012313c81a95be0
SHA256

c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d
SHA512

b08ad87c757236e1eaa3669c185610aae19c83ed51248d9bbeb7c5ded936d6ce45f7fe7fc71b9fdbec1fb2ace9bac397d0e72b3b885917a9f6f0030c8ecddc1d

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?DFB941278EE2558CAFF12CE3F728BA43 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF12CE3F728BA43 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?DFB941278EE2558CAFF12CE3F728BA43

http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF12CE3F728BA43

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note

Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?DFB941278EE2558CAFF12CE3F728BA43 Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF12CE3F728BA43 This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?DFB941278EE2558CAFF12CE3F728BA43

http://lockbitks2tvnmwk.onion/?DFB941278EE2558CAFF12CE3F728BA43

Extracted

Path

C:\odt\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?DFB941278EE2558CB40B41D429FA1B53 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?DFB941278EE2558CB40B41D429FA1B53 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?DFB941278EE2558CB40B41D429FA1B53

http://lockbitks2tvnmwk.onion/?DFB941278EE2558CB40B41D429FA1B53

Targets

- Target
  
  c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d
- Size
  
  445KB
- MD5
  
  1a7eb7fc0b6c28388e1f1e3beab03892
- SHA1
  
  0fdbdc0e8aa192f245ce68888012313c81a95be0
- SHA256
  
  c66519665d397eafb24e44f562e822fc7c98f02afe44f9ab179ee8048af7596d
- SHA512
  
  b08ad87c757236e1eaa3669c185610aae19c83ed51248d9bbeb7c5ded936d6ce45f7fe7fc71b9fdbec1fb2ace9bac397d0e72b3b885917a9f6f0030c8ecddc1d
Score

10^/10

lockbit evasion persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2