lockbit

General

Target

f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d
Size

627KB
Sample

220427-wj2xjsfga3
MD5

042227360a51cc44e56bae065eec9a90
SHA1

85b0ec628c72b07e930a87158c73c71651def497
SHA256

f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d
SHA512

97dcb2c9df3f3d86faa64fec1e4377029ae3b8792fc1421e70cf971336aed885be0db6f48501c601780a790a3cb986686f04df2857899835dfc6d5582996723d

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note

Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9AE90FBCE3CE3B2CD

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9C4D1CFE696A5EF31 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9C4D1CFE696A5EF31 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?9B7FDA8D33FEC3F9C4D1CFE696A5EF31

http://lockbitks2tvnmwk.onion/?9B7FDA8D33FEC3F9C4D1CFE696A5EF31

Targets

- Target
  
  f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d
- Size
  
  627KB
- MD5
  
  042227360a51cc44e56bae065eec9a90
- SHA1
  
  85b0ec628c72b07e930a87158c73c71651def497
- SHA256
  
  f3a8fbd973addb975bd4e9e86772b276ae7cc8bac3c1a0f94cf88f518efd348d
- SHA512
  
  97dcb2c9df3f3d86faa64fec1e4377029ae3b8792fc1421e70cf971336aed885be0db6f48501c601780a790a3cb986686f04df2857899835dfc6d5582996723d
Score

10^/10

lockbit evasion persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2