General
-
Target
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5.7z
-
Size
27KB
-
Sample
240309-kst3hsfb7t
-
MD5
99c29321d0e18c6118be1299a4b84c87
-
SHA1
180c03d7bc9352ffc0d64cbe2fc70c639cf99c20
-
SHA256
129eb76ff1420e8484f55641518924812662bd50af797067262082829043b9cc
-
SHA512
6b1683b8caa8c4753366594aa6bf3215b420b5af10d0a5539174f4f64cb9e78530010b7187bb5a41b598a9309e555200ddafdc2a0c7b53359d73c6a6ba3d371e
-
SSDEEP
768:KrcRyE/AQ0bx857G8Mzk9XI5GSaojMQGD:dRyqAQ0bxyqYIvVgQS
Static task
static1
Behavioral task
behavioral1
Sample
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5.7z
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5.7z
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\P0s5GuiYn.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Targets
-
-
Target
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5.7z
-
Size
27KB
-
MD5
99c29321d0e18c6118be1299a4b84c87
-
SHA1
180c03d7bc9352ffc0d64cbe2fc70c639cf99c20
-
SHA256
129eb76ff1420e8484f55641518924812662bd50af797067262082829043b9cc
-
SHA512
6b1683b8caa8c4753366594aa6bf3215b420b5af10d0a5539174f4f64cb9e78530010b7187bb5a41b598a9309e555200ddafdc2a0c7b53359d73c6a6ba3d371e
-
SSDEEP
768:KrcRyE/AQ0bx857G8Mzk9XI5GSaojMQGD:dRyqAQ0bxyqYIvVgQS
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5
-
Size
58KB
-
MD5
eeadfcccb6d95dc04d81f68ae7865f8b
-
SHA1
2f78abc001534e28eb208a73245ce5389c40ddbe
-
SHA256
f4ac4d7bbd9998071b17ef30d3cb7e4126db06cdcc0c4b3548a01012a00fd1f5
-
SHA512
6cdbf64ea30a47d4a6c757a0a8c0e57cf7b6e31806651508d9b350413893997f3682ed2b0a99788ff497be38c8466a976938ab7bc73efbd46d4b0286b4280bcd
-
SSDEEP
768:TKGA9gxT1Q6fAMmLtn+gCYeXwtI7TKTZID1njtVPjRsFyV8amvl0ZOcv/k/tJpdx:Ty9gZydLmT8q57sFGovl03e3Dx
Score10/10-
Rule to detect Lockbit 3.0 ransomware Windows payload
-