General
-
Target
Lockbit 3.0.rar
-
Size
3.2MB
-
Sample
240303-w23lssea7s
-
MD5
feb587492965e27725f12cebfe9c0f63
-
SHA1
043fa82cd179a0c0d33d958534d0ac4a266af4fe
-
SHA256
41a698eb7c58022975ddb16d80e444234a71b1a3dfb3e017ad80a6ac8c541063
-
SHA512
5fc600d9a92dacf88f25dd9dc8882d2690ac814c1d785438e5fca6fd8b209b5da994545a70470b049c4f1bf0c4f235bacb4948e684df6617ad0764f9812a5ab1
-
SSDEEP
49152:8qITzbEX3VLCIWxBR58XL0Ech+4YcU/4ni+XaoCsqDLH80rGUol7CUDIM7Ozc8Ov:Hkzbk+R5owfKV+X9CTv3aUoluUDrCcnx
Behavioral task
behavioral1
Sample
Lockbit 3.0.rar
Resource
win10v2004-20240226-en
Malware Config
Extracted
blackmatter
25.239
Extracted
C:\SQ7L3gXNR.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Targets
-
-
Target
Lockbit 3.0.rar
-
Size
3.2MB
-
MD5
feb587492965e27725f12cebfe9c0f63
-
SHA1
043fa82cd179a0c0d33d958534d0ac4a266af4fe
-
SHA256
41a698eb7c58022975ddb16d80e444234a71b1a3dfb3e017ad80a6ac8c541063
-
SHA512
5fc600d9a92dacf88f25dd9dc8882d2690ac814c1d785438e5fca6fd8b209b5da994545a70470b049c4f1bf0c4f235bacb4948e684df6617ad0764f9812a5ab1
-
SSDEEP
49152:8qITzbEX3VLCIWxBR58XL0Ech+4YcU/4ni+XaoCsqDLH80rGUol7CUDIM7Ozc8Ov:Hkzbk+R5owfKV+X9CTv3aUoluUDrCcnx
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Renames multiple (678) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-