Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8

  • Size

    862KB

  • MD5

    96de05212b30ec85d4cf03386c1b84af

  • SHA1

    dbe5243c6ea5cc4cfb3edf042bd94a59cf9a0e64

  • SHA256

    00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8

  • SHA512

    3a77e9dad5348a612ee83284ed7e098cc19375a92910756bc4d9274f484a68b0a73ce39fef53a1d12fecccc1daf5d48a1d264c18b1fe8ed4741e1a95cbcbdf47

  • SSDEEP

    24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+Q9F:dAfSrWW4g+7Ht+UmxJe6

  Score

  10^/10

  lockbitdiscoveryevasionpersistenceransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716

  • Size

    145KB

  • MD5

    7966a61801e560b0031ba0e7d5864456

  • SHA1

    bb737041b092879f10e400a599e5301d186bb6d9

  • SHA256

    01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716

  • SHA512

    475f41efdafcb2a19e3d0c47b824f13f7ad609412d5d99bd08346795e3f98a14c96ab62f1ff0305a9fffc8d6c025f7c4c2e8a1502bfdb17484add606539f94d6

  • SSDEEP

    3072:pqJogYkcSNm9V7DF78cwcmphqvbAw/rKfGT:pq2kc4m9tDp7wxhqnm

  Score

  9^/10

  ransomwarespywarestealer

  • Renames multiple (455) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4

• • Target

    0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049

  • Size

    959KB

  • MD5

    6fc418ce9b5306b4fd97f815cc9830e5

  • SHA1

    95838a8beb04cfe6f1ded5ecbd00bf6cf97cd564

  • SHA256

    0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049

  • SHA512

    7b9e17dc75d83f6b6ac458f29e07faf30e50d88d283cb50fd64b44730622da48702059e416649455c082ff28328fd70e3acea61527e86a7972978219a7bfcc06

  • SSDEEP

    24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdLF:Ujrc2So1Ff+B3k796l

  Score

  10^/10

  lockbitdiscoveryevasionpersistenceransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral5behavioral6

• • Target

    068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd

  • Size

    147KB

  • MD5

    75256873a03f4a4bc073185f48c1097c

  • SHA1

    e9023061def67ba21c09826fadc1607fd7f71d88

  • SHA256

    068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd

  • SHA512

    4b718093ad42d7b7b72498dfcbcfd1b39c980ef44e999b7035e6bfe6b782aad6b7553832f1efee45003d9b0c56bf2e408ca55082c550ac4faa19f199f366dede

  • SSDEEP

    3072:s6glyuxE4GsUPnliByocWepvdHFdjFpZ/fgyVF0dj:s6gDBGpvEByocWetdHZ/fgKF0

  Score

  10^/10

  ransomwarespywarestealer

  • Renames multiple (9399) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral7behavioral8

• • Target

    0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9

  • Size

    150KB

  • MD5

    ebe673b2ee28dd65565f2f389279ac47

  • SHA1

    bcebe09c61d3e6c47aefcb6bca0882752e0053a9

  • SHA256

    0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9

  • SHA512

    c100672fd9055e0d07996347dcc59b5f689dfb607222d4213d4aea741e85d8db8837a9c46f3343fba82095d0734a21315df1c55f404294da13074a5567e5ad56

  • SSDEEP

    3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/R:pq/1VP1OyysNmJyXsqqD/ls/R

  Score

  10^/10

  lockbitevasionpersistenceransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (6448) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral10behavioral9

• • Target

    0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509

  • Size

    162KB

  • MD5

    44e8c23bfb649ecf4cb753ec332899dd

  • SHA1

    465f5b6de78ee184f1ee3400e4edaa0e85558d9e

  • SHA256

    0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509

  • SHA512

    81f369f044e3b403aae8789c741cbf16e167a38386ef38c49d57a3c8e568b5b75d881f92881aeb10a918ed449ab89b27d70c2809cd956883660ed0202c0caf51

  • SSDEEP

    3072:NEWBPJgr1sgLFXdJ6Xx7OchgXC6TESq072WHI4nL2knI+eT:N71J4sgLBd0Ocz6TEBmHFnLm+eT

  Score

  10^/10

  lockbitransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  behavioral11behavioral12

• • Target

    0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e

  • Size

    959KB

  • MD5

    22e93a1af0bef6fb78f6054b93726f54

  • SHA1

    6dbea516bd91fbde13203795f2128af13f158009

  • SHA256

    0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e

  • SHA512

    164b2eefea73fedcf9f0dbc77a068bb6ea9a3c0046ba46f951307f4849b6d67b2e0c045982de235e46cce6b1090caf55ea28563476730265c6af29ac87cb3c3c

  • SSDEEP

    24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdCF:Ujrc2So1Ff+B3k796U

  Score

  10^/10

  lockbitdiscoveryevasionpersistenceransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral13behavioral14

• • Target

    0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335

  • Size

    151KB

  • MD5

    1fbef2a9007eb0e32fb586e0fca3f0e7

  • SHA1

    3e86304198d1185a36834e59147fc767315d8678

  • SHA256

    0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335

  • SHA512

    94de457c74b783413514bc5804e86f5e1f0962dc03acf12d0a22c8b383b099518242314862417c24e5b13101b135d36dce285f4db11c989f3bc4331ce1b437b0

  • SSDEEP

    3072:3m5H8y2mrr217uS8nW+cpsCp2cOy1cjKCy8YjKGiyWDDuMqqD/E0a3Hv/:3MHf2mr/Ww74cdlzXFqqD/Za//

  Score

  10^/10

  lockbitevasionpersistenceransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (8716) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral15behavioral16

• • Target

    10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd

  • Size

    103KB

  • MD5

    e9f6513c37debcce50e9633aefa757c0

  • SHA1

    e7623d6cb0cf234b9f3e3f8b14f63e2077441a0f

  • SHA256

    10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd

  • SHA512

    de6d502b6bb6d6b46d5b0170db2e3f22f376f5370b6fe6793efbe3ea2207e65033d0b3e0b195b90833ec305bd0decffb6264f2dc973160dbdc330646af242d74

  • SSDEEP

    1536:QzICS4A30TY1kUS/U2ztdS1I6DdL9Ta1lx1411ey2NzPBmdy6h+/:vJ0TYyUS/U2RgGWL9+zx1c1eXNNmdA/

  Score

  10^/10

  lockbitransomwarespywarestealer

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Renames multiple (424) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral17behavioral18

• • Target

    160c97289764c37afe1a11f72537e95843a9c37a9c5fa02e1046f6b002315021

  • Size

    153KB

  • MD5

    213838221c47c1d5fd11f7eaaf65865c

  • SHA1

    e0444a48c57f1b4a4a46e363bbd421c50f3deca7

  • SHA256

    160c97289764c37afe1a11f72537e95843a9c37a9c5fa02e1046f6b002315021

  • SHA512

    4b17e26f911a1d7fe853ec163d571d86d55944e484fbe4f66718dd3dd2060e8b8502e4df6cbf13b21ad8645eac860ec91266a93aa176d4891b7ef43a40b5e220

  • SSDEEP

    3072:M6glyuxE4GsUPnliByocWep+EE2GLTlsuGb:M6gDBGpvEByocWeBGLTlWb

  Score

  10^/10

  lockbitransomwarespywarestealer

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Renames multiple (459) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral19behavioral20

• • Target

    19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0

  • Size

    959KB

  • MD5

    fec0ba68b3118f490dbee9dc5cc382d4

  • SHA1

    c5a76c237314d970fb5acfc118c1f1109d012704

  • SHA256

    19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0

  • SHA512

    4c202c11503607baa0fccc23223933eaf1ffe052607f46f3d596520ced90359d1bcf1369ce335d4b63de9c221cf137d6354ce88fead6e3164c54903c8e20f81c

  • SSDEEP

    24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdMF:Ujrc2So1Ff+B3k796W

  Score

  10^/10

  lockbitdiscoveryevasionpersistenceransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral21behavioral22

• • Target

    1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18

  • Size

    150KB

  • MD5

    1f4f6abfced4c347ba951a04c8d86982

  • SHA1

    a4c486b0926f55e99d12f749135612602cc4bf64

  • SHA256

    1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18

  • SHA512

    ae9d631a193d04194bcb54ccf5573730c04b2d9d732addf04af2100e7d67584a3cfba67cfaa2a9da05099d71c56dd58cfdb9f58d070b72ae58d0add20cf0afd3

  • SSDEEP

    3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/:pq/1VP1OyysNmJyXsqqD/ls/

  Score

  10^/10

  lockbitevasionpersistenceransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Renames multiple (9311) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral23behavioral24

• • Target

    1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518

  • Size

    113KB

  • MD5

    44a19bd034e150b21084da75ad65ef0c

  • SHA1

    72666d6482fded7e524591a2bd61bb14494560a2

  • SHA256

    1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518

  • SHA512

    e9801d9386ec3cc0a8086a790e8586847f180c1562d1ddcee06307edd44e2267a98018f2b51add2c9136af949da59aa9def76b49b66e6e4235d69d1b9246b99c

  • SSDEEP

    1536:+zICS4Az7zr5gUke9jyAa1d0obdsx1R4hRltKHvkT9SDFSDevAwxOOr:l1735ZzNwX0obdi3gJKvkBShSDaAHO

  Score

  10^/10

  lockbitransomware

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral25behavioral26

• • Target

    1eb0b48ca74c119b53d372de7d639f0bcb1337fb526347fb3b22f62214280e1d

  • Size

    158KB

  • MD5

    fd618940c30715bc3a539f9c9592baf9

  • SHA1

    8ff1b7306d00e6d04bcbff68c57acf4895d0518b

  • SHA256

    1eb0b48ca74c119b53d372de7d639f0bcb1337fb526347fb3b22f62214280e1d

  • SHA512

    caa6505e9bb5ae38589d2f2ad2ae8f2cc5e9381d883c5a16663f2bcfbf54826d682f6c12f6c89100d2f8059965b3f90dc9d4cc2d2f41fceed64b46127cf59f29

  • SSDEEP

    3072:W/LecLDzqMDMXSBTWD85cb0E/fsO+L0ukZsqSkq2jSU:W/pDzqMGSBTWD85cb0AHya4kq2O

  Score

  1^/10
  behavioral27behavioral28

• • Target

    1f0e4cbc1a4b52b6d7e4188e4a835a904cf783c75db9a066df4201452bd9647d

  • Size

    153KB

  • MD5

    9876648d8e8d857bd698c39cfa0ca3a3

  • SHA1

    bb3ef4fa029b5e7ddb4666b68406d570764c908e

  • SHA256

    1f0e4cbc1a4b52b6d7e4188e4a835a904cf783c75db9a066df4201452bd9647d

  • SHA512

    63a94dfa67f9cbedde1c3af4d1c9178eb0f84049c86dbdbaefde11b50ada2de846d72a7bb1848d72677844f810e8b2812815caee774f568a899171b95b8cbdce

  • SSDEEP

    3072:uqJogYkcSNm9V7DZqX7A+Rf5KZXxpU756T:uq2kc4m9tDgZf5KZX325

  Score

  10^/10

  lockbitransomwarespywarestealer

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Renames multiple (446) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral29behavioral30

• • Target

    239c9969fd07e1701a129cfd033a11a93ee9e88e4df4f79b7c5c0dd5bba86390

  • Size

    153KB

  • MD5

    bb78df384ff1d296d1f0b59803df89b3

  • SHA1

    39c9235f96cf39a24c9907ac9ff5ab58de837bac

  • SHA256

    239c9969fd07e1701a129cfd033a11a93ee9e88e4df4f79b7c5c0dd5bba86390

  • SHA512

    b682f26d3baf33ab2f11036f1c0461c1c022d8073989db5f6cfaaa84655bc46d8fa0dac7b1842c74c69d7ad640c9d390dec946cfa8dd08efd240886e816a3288

  • SSDEEP

    3072:5qJogYkcSNm9V7DvjFHHjHLuHk7XHURLPGwAcT:5q2kc4m9tDFfXkuwA

  Score

  10^/10

  lockbitransomwarespywarestealer

  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Renames multiple (436) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral31behavioral32