lockbit | a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0

General

Target

2024-02-23_951a7673b6ad24bfcbf086db0873c7f4_darkside
Size

146KB
Sample

240223-b7msbahe8z
MD5

951a7673b6ad24bfcbf086db0873c7f4
SHA1

67275f726f320df71bbeed04804571cf9e73eb42
SHA256

a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0
SHA512

3b358dd9eb8fa2d18fd436351f21d33dfe5e30057edd9df2e242b1520b447c5efcaa964cb6a8024ed2cff6ff6e60c1f751efc1c9fd8e430352e960d820f6ad36
SSDEEP

1536:izICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDstorzC23uqOKqpGX+1KBh+QHzT:hqJogYkcSNm9V7D1O9FpN12h+QTT

Score

10^/10

Malware Config

Extracted

Path

C:\2zAdN8qob.README.txt

Ransom Note

~~~ Unlock your files! ~~ Hello, we hacked your PC and encrypted all your files. BUT!!! Fear not, you can decrypt your files and recover everything very easy, You just need to pay a smaill ammount. this is just bussiness. You pay the ransom, we give you the file to decrypt your files, and we move on. We won't attack you again, or talk to anyone about this. Send an email to [email protected] or [email protected] and talk to us. You would need to buy XMR (Monero) to make the payment, it's very easy. or follow an online guide, ask us in the email if you need help. >>>> >>>> Your personal DECRYPTION ID: 27A6097BD4987E4AE6BA315A2B3B52A2 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

Extracted

Path

C:\2zAdN8qob.README.txt

Ransom Note

~~~ Unlock your files! ~~ Hello, we hacked your PC and encrypted all your files. BUT!!! Fear not, you can decrypt your files and recover everything very easy, You just need to pay a smaill ammount. this is just bussiness. You pay the ransom, we give you the file to decrypt your files, and we move on. We won't attack you again, or talk to anyone about this. Send an email to [email protected] or [email protected] and talk to us. You would need to buy XMR (Monero) to make the payment, it's very easy. or follow an online guide, ask us in the email if you need help. >>>> >>>> Your personal DECRYPTION ID: 27A6097BD4987E4ABFC80C7437B0C64F >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

Targets

- Target
  
  2024-02-23_951a7673b6ad24bfcbf086db0873c7f4_darkside
- Size
  
  146KB
- MD5
  
  951a7673b6ad24bfcbf086db0873c7f4
- SHA1
  
  67275f726f320df71bbeed04804571cf9e73eb42
- SHA256
  
  a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0
- SHA512
  
  3b358dd9eb8fa2d18fd436351f21d33dfe5e30057edd9df2e242b1520b447c5efcaa964cb6a8024ed2cff6ff6e60c1f751efc1c9fd8e430352e960d820f6ad36
- SSDEEP
  
  1536:izICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDstorzC23uqOKqpGX+1KBh+QHzT:hqJogYkcSNm9V7D1O9FpN12h+QTT
Score

10^/10

ransomware spyware stealer
- Renames multiple (311) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2