lockbit

General

Target

b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893
Size

81KB
Sample

220824-x5m6ysaahk
MD5

3ee21dbaa37d0048e2e174cb41a664d6
SHA1

f7799dc7530c3234dd2d5c11b74361b7ec1daefb
SHA256

b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893
SHA512

7cfcc286522cc1d70f4f0d83e8a6e9ed27a7b94ead3f272a271ce1bf6708c91b0f19ddbf7cdebe44239c903142bd8f9b1949d17cbce0dd39e9491acb9744e947
SSDEEP

1536:+uBQrT1eLBBdU/1GJj4UgvpedwwtVNUmrTF3MqqU+hV2xQie:+uBUwX0C4Vvs2wT+mr5MqqD/Fi

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: �iWZuyP7ksR1Dh7AUQsobNSR01MgVTLtA2LqvnBDjLUDRgCze3ZT/+vRJCA4Oy8nX 6ZIwIhvr29lEG8CE9LjB7TsMiKpqXp5oeBdq0ut9gGUbUYJXLrkErCdHmEnc9var DiJCJ73OFL2eFytIWWY/MV3lli3E7teh6QdzYazYG34ODSUu8UKSVUBfr6qIAUUA krCL9GIYdUA+BoDFEludWqgGAa/ZlsBvGHGhR8/hJBneEY3eKIZJNMHHKVJCwnYp jp2C7igsls8c7H2k53ddsmpFM9oftSvK+g67olChGiKnuHVojfe09xq/OG5uogkI a3KV5DBtZ6g0tkSt93aH/WqiyvxoRGJWKVoxOXz9oo5I10Pm1tdFjc/BBWX8mEsd KN1qrZRsIIbJ0+vOJYK9F6VZfD0hPTiqxvijv7tC5BLCXMin+2QoRrykzC6idi+a Sw11hnowI3FyJC9GpJj7G4YhHFBvL/cckdsaCc430D+TMjVMgqHuoUN75Lnzohi2 crWw+SAXOwk+DmRZ2KpPMgoIjRrLHiuReLN5ekKNii/E6fo19o5AGH3r9cYYh1XH sVf3ib7e8+TM4C0jLsawCgTYispQ8RD9WrNCF9sgoW/FYM8PFQIbDjUBTpfmNRR7 9kZafCdzaLsDdqn2/1qXO05MULT8BeF7239FwWc8tNNRoLDhgXlKob7X4GqrCB3N 6ezZobJC6fkG2Cbt6xfgM9Hj4Qxzagbmvy5YrXfC1yls80K2Du+8XsGdWiOaSouY QShfGxp/CKjdiZSFV/25FgQEjdi7HKrbdGY1NC9T4Ho7789kz/KJMsHEwlnzrajD MSICVv4IwvZo1zYB6PhkdnfqxScaoR9YVi3C/1D/uznVFFMK2bW7LCAWCto0d996 Kp/oameloWu3Qt4iBHSBbmF8QPfLXHVitVQmZtmJyxesOr5bwUGx9JmkTAbuD5LY 73kqH5QETaGTAqTkEUbHrAiyWvCMgRjSWArqzpe2ykWtnG4/iubB2M7/ylieVnLo XOptqZeZOBa2T0EZHqi1QQKwVqYgkJ9jnpfPjdAprUpLHsxmmMSWuLmnJ6PePdQR ccWhqJFD+4JGF6NVXQC5wj3ZAoLHCHEgD5zdwnuepn3RNtEqYtxyrdyecIcGh/ZA qPif6fifCEKHj7wTNGnrb8m39Hgcha3+pM06cYIjhjk+f0yOOUG54Bd6Zpft2Jyy rFd5kBw2KYELSNXxLF7G7PO75FgfPMd++DDvZHoMEHGCuj5eziNOzejfyj+/kE6F xqyb7iZQvGSvykx201RN+pWQG3zmWmPrTK4dPH1aW6vL+uGP1R9kiKuKL510HYDg Iiptsc1KC8FQutx7XchkW3n4pRjKmVCs34uosmLjgKbp77q3VtA+8waqvm+CgBlS CFPJSDdCbFeX0z16DoNa2EGTfdemEwkJbfA7yIBJtQrFjKUhH1pZV2zTQc7jMRvF thcz4Cwl5J2rjf1r3gE02jQ5pX/UZtGyT8TL3zjPLYw9ZpbJkeC6o4lravEWu8C3 l3ByS2Vn+Vf+knqBLc5oHdXKrA1heKDskvZ5USTr9mGgIC1e0ncEmKCQ19TaDvTU viSCa7LkQNePBivutd7spGuzSgcTT6EV2X32ONt7OotvFW0VZXUchFmJVm9MZCVO SPlARno1ypvo7GueAHyZWAV/PcKiWnCmpakk19p0yrM=

Emails

[email protected]

Extracted

Path

C:\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! There is only one way to get your files back: 1. Contact with us 2. Send us 1 any encrypted your file and your personal key 3. We will decrypt 1 file for test(maximum file size - 1 MB), its guarantee what we can decrypt your files 4. Pay 5. We send for you decryptor software We accept Bitcoin Attention! Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price(they add their fee to our) Contact information: [email protected] Be sure to duplicate your message on the e-mail: [email protected] Your personal id: �Ce3YhOSP5hi9+rvHRQsPtxQLRUGct4JkOcveF1oDOdLSITpa5PGT3Vjdwg4Pvy9q OH2BC4us0FOnh+DFu5R1R52r0OEHXmGZcVpwd2UJdyknB0yYi+jq/qC9q3LZrd14 9PEq6VG9DYEYaUABGXXFgS5fWCT+MP5dZF8rLwx3TVLg0EgMJFd7IlM3Hqz53boc Zb++f9/b1Blgd/3kwfTYflfpWuZ9wFGVGMlSz+FsArQzfdfrN7uSjniTjW3ttKFD LU6QcKVTo9OLlWMc+ZQNojZjUgz11tXWlIhc9xU/QMuo8FLKf/9MrSMaCFngWKjR 6tsttlhHHzeMouNDCoY0QoTbDjxVrle1+U73RGu50sqs7ea26+UGsqG2++ABXlwQ ocrFC9O9p6zTs3d2PKaxsIhfR/UIs8Ap7+AhjzK8lnxVcIhb3Snx8lDDN+EJQOJ7 Ts9hiLhhsif8gyyBsaBlctC+JT6HVsJ06SW4GGutz6UPtBp5n9Dr7XW/dmdNXFYR heO/SlZw6rg/NlPXO7fYPys7js1rk4SSivWXb86OFzzR/wXYH6QVm7h9ZnPAZT9Y RmhZMn1RFPVVAQ45NSaJantEn6X+oA3hDwnW8OXbRL6qnAP48MsjHizJC8iWtzvu QK88YnRKrilFe+yf67IgtzCfLx04TGlglR88myy7WuANedt0odh9yFhKt0FCEWru dO2sQlfLAcyu9fXSLdS1I6eH8K33bMKK/EmoRlK7WYsq5U3VDV28hOa7X+tivkxy NJdBbMbgR1eB+xsCHfUYTnPZvXW1fqJIR4VD6/fUjFmynPXltlYlVDCIdqr5jZeR RH8QtWLx+9fh5Q66cCI0MZqeyfFtA3AfjN/MoV8zK+OCI3LPbFImcgB/JhKCJ51v +KOHZO/8Lk0qElOvXD2t/MFJYzBK/x1GqrSg06z5Er8mOLzZQvUyYXrLmpNBmvMy wHAPLLw7jevdSofk04i8DzPD2VVsD7OxZIMPzTggJRbsNurACJaGLb1IR56Krq3m GAAUd9dlTNA/QBz9Kyk6eTU84bw7NlGfIoAt5PpRWw0SMQ3ZZqdmDIXXZwn4Pq9D uVrZchX2aELQSQ7Wf19qV+7CXwxbv3Fp3SuqJfIc0ssIat/MeH2kQP7mxZmONSps 7vEZIp5jRihICyBfx05VbM3sebY4CIrLUNRXW+kYFXZUTZRkJN7uJ0BdWekejuQH DDfGHvv56NhkAxRAmA8eeBPWjsMzj6ujyw2NbQV8fIicR3YB9UsZqo7XqARgM1K9 46iesR7CAcHGkGdteDi59i193Nz7WfN4zz36vIOPPjjlecxz0JbcM4iubbkjkOqI Phy+fRaRWkybY4jUS3TIfQ+pDZrgvUgIjVKvw+k6o4VSL0DXuKmQOeiYJb5flp8N Sd5gK9p+qGJ1GJsgnrKxYGn1SfHyIy+GkgrnrocLkIdbScJDHyJKYU0NO3ndzuj3 V8pqUhwgpnut5iaLAamI5kAXtE86m4Br9A0UuU77b/X7zbmJq0H6tzwdMQAQf7Xw XMhKJAjsT7o/nwIqHR/LgzwkQNoAG4o9P4kf2oPIZpYB2jNftxJV4ZzOO6qEG5jT /7BU4KgZPcBEqM+fvONuyapNjpQFi2s3wqY5B2TRFwX5BbNt/iiddn/bYByIk41s WlCaBVsFzcpIrI0yedHM6wW+jLEIFNvO2oXjStYb9Oo=

Emails

[email protected]

Targets

- Target
  
  b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893
- Size
  
  81KB
- MD5
  
  3ee21dbaa37d0048e2e174cb41a664d6
- SHA1
  
  f7799dc7530c3234dd2d5c11b74361b7ec1daefb
- SHA256
  
  b02d57f1c4f7f233044a56fdc57c89b6cc3661479dccc3b4cfa1f6f9d20cd893
- SHA512
  
  7cfcc286522cc1d70f4f0d83e8a6e9ed27a7b94ead3f272a271ce1bf6708c91b0f19ddbf7cdebe44239c903142bd8f9b1949d17cbce0dd39e9491acb9744e947
- SSDEEP
  
  1536:+uBQrT1eLBBdU/1GJj4UgvpedwwtVNUmrTF3MqqU+hV2xQie:+uBUwX0C4Vvs2wT+mr5MqqD/Fi
Score

10^/10

lockbit evasion persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
behavioral1 behavioral2