General

  • Target

    2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495

  • Size

    959KB

  • Sample

    240314-eqjwwaaa9z

  • MD5

    9dbb0838eb857c2cf22ca5407d6c85d7

  • SHA1

    fe486f8741f2f94fc79def45b4872030e5504d3a

  • SHA256

    2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495

  • SHA512

    1abacf15c959e3f31e54385de34ecec00291aa2dec2e00d663939edf93ff975a1303d579de1d89d00cf557e2e2984862e993ab05f1e0b125eb93d01d5618f417

  • SSDEEP

    24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdMF:Ujrc2So1Ff+B3k796u

Malware Config

Extracted

Path

C:\Program Files\Java\jdk1.7.0_80\db\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 4CBB5D743DBF772009B7268B32239494
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Program Files\dotnet\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 4CBB5D743DBF7720DDD6F6C2DD35C56B
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Targets

    • Target

      2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495

    • Size

      959KB

    • MD5

      9dbb0838eb857c2cf22ca5407d6c85d7

    • SHA1

      fe486f8741f2f94fc79def45b4872030e5504d3a

    • SHA256

      2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495

    • SHA512

      1abacf15c959e3f31e54385de34ecec00291aa2dec2e00d663939edf93ff975a1303d579de1d89d00cf557e2e2984862e993ab05f1e0b125eb93d01d5618f417

    • SSDEEP

      24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdMF:Ujrc2So1Ff+B3k796u

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks