lockbit | 2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a

General

Target

2024-02-23_9413646e0b2c875420777060c63ae83e_darkside
Size

147KB
Sample

240223-c54hqaab5t
MD5

9413646e0b2c875420777060c63ae83e
SHA1

be4385c5e242ddc9970eafd1d12c6d373cf88edf
SHA256

2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a
SHA512

048568798075047113e37ef1a06c635c82533d14e52dd64089897903f1ce78c925a25f09451e6f20334368e577608c7b0b69bc7e9c04a340bd000f9931e8805d
SSDEEP

3072:n6glyuxE4GsUPnliByocWepo5prl0CIny7FZN:n6gDBGpvEByocWe0L5sy7Ff

Score

10^/10

Malware Config

Extracted

Path

C:\WjbIleM3b.README.txt

Ransom Note

----------- [ Welcome to buhtiRansom ] -------------> What happend? ---------------------------------------------- Your files are encrypted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your files. Follow our instructions below and you will recover all your data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. How to get access? ---------------------------------------------- Using a browser: 1) Open website: https://satoshidisk.com/pay/CKiJU8 2) Enter valid email to receive download link after payment. 3) Pay amount to Bitcoin address. 4) Receive email link to the download page. 5) Decrypt instruction included. !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. It WILL NOT be able to RESTORE. !!! DANGER !!!

URLs

https://satoshidisk.com/pay/CKiJU8

Targets

- Target
  
  2024-02-23_9413646e0b2c875420777060c63ae83e_darkside
- Size
  
  147KB
- MD5
  
  9413646e0b2c875420777060c63ae83e
- SHA1
  
  be4385c5e242ddc9970eafd1d12c6d373cf88edf
- SHA256
  
  2da975fee507060baa1042fb45e8467579abf3f348f1fd37b86bb742db63438a
- SHA512
  
  048568798075047113e37ef1a06c635c82533d14e52dd64089897903f1ce78c925a25f09451e6f20334368e577608c7b0b69bc7e9c04a340bd000f9931e8805d
- SSDEEP
  
  3072:n6glyuxE4GsUPnliByocWepo5prl0CIny7FZN:n6gDBGpvEByocWe0L5sy7Ff
Score

10^/10

ransomware spyware stealer
- Renames multiple (340) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2