General
-
Target
8961451918.zip
-
Size
75KB
-
Sample
230202-29atmsca9v
-
MD5
c348a516d5880cc81ff35057fec1611b
-
SHA1
90bf3bd3c833b302a1e2c8871fdad376fbced557
-
SHA256
c10065ba59100e1b579789120c5ce68ec2738b636749ba30bf6eca74ab8b0b71
-
SHA512
553d3d7b7ed5f6cc461c7ecf7d266f4a4888314d6ffff2bcecff9efbc7b57b23db78a5b0b9815a8d91d7fb4267f9b07f6ce4d678cdcc7972bb7bea4ee6f72f06
-
SSDEEP
1536:tPAN57RVisd+4Qj2ZqNmqBSnuxbQ6NQkAX/wb04N+HL:ZAN57RcsI1BmHuJNNQk8/wb0xr
Static task
static1
Behavioral task
behavioral1
Sample
a629e4cdc326f8c4f63bd1794f5eeb8f6a86f289d715bdf944fa46e085920cd7.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a629e4cdc326f8c4f63bd1794f5eeb8f6a86f289d715bdf944fa46e085920cd7.dll
Resource
win10v2004-20221111-en
Malware Config
Extracted
C:\vXVM5UI4x.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Targets
-
-
Target
a629e4cdc326f8c4f63bd1794f5eeb8f6a86f289d715bdf944fa46e085920cd7
-
Size
106KB
-
MD5
59c2f5f09711902e3a75f726ba31462e
-
SHA1
74ecfec2d8ad276f2f4ebc55a0718d3ce4110e1b
-
SHA256
a629e4cdc326f8c4f63bd1794f5eeb8f6a86f289d715bdf944fa46e085920cd7
-
SHA512
5ea6060fe38c92269cc751dfbc8127166c5be5f421ed38b93aaff940d8908f87a52458268e70a2c06ea47dcd0c1e109787b5b3c5821c746ee337da518b632a41
-
SSDEEP
1536:qzICS4A30TY1kUS/U2ztdS1I6DdL9Ta1T3P07nCVuhKhl3EgemhbPcG:ZJ0TYyUS/U2RgGWL9+OguhKb3E9gPJ
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Sets desktop wallpaper using registry
-