lockbit | 9b5f1ec1ca04344582d1eca400b4a21dfff89bc650aba4715edd7efb089d8141

General

Target

LB4.bin.exe
Size

146KB
Sample

240328-dt6z5sdf8w
MD5

e544b3593a6441f9654839e11aa0bea5
SHA1

f7d5e39e1b031002887b4a7d8a8ef889c892c3e7
SHA256

9b5f1ec1ca04344582d1eca400b4a21dfff89bc650aba4715edd7efb089d8141
SHA512

9c6f2a04307b0a41e9aaf7c9c68dd901787d7ad65e80f293893c21e026e2de11b729b0fdbeb0c0926214e85d9b4c3473e94017be2e0fb49ed5a91fdff7ca9e83
SSDEEP

1536:KzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD3pt0uCM0Ej+/dO9fRQvffQBfFT:5qJogYkcSNm9V7D5NuEBfWf4BfFT

Score

10^/10

Malware Config

Extracted

Path

C:\xa1Xx3AXs.README.txt

Ransom Note

~~~ LockBit 4.0 Ransomware since 2024~~~ >>>> Your data are stolen and encrypted Price = 1000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = jimyjoy139@proton.me >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: A3138014A48684D6D525F3F372263313 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

jimyjoy139@proton.me

Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Targets

- Target
  
  LB4.bin.exe
- Size
  
  146KB
- MD5
  
  e544b3593a6441f9654839e11aa0bea5
- SHA1
  
  f7d5e39e1b031002887b4a7d8a8ef889c892c3e7
- SHA256
  
  9b5f1ec1ca04344582d1eca400b4a21dfff89bc650aba4715edd7efb089d8141
- SHA512
  
  9c6f2a04307b0a41e9aaf7c9c68dd901787d7ad65e80f293893c21e026e2de11b729b0fdbeb0c0926214e85d9b4c3473e94017be2e0fb49ed5a91fdff7ca9e83
- SSDEEP
  
  1536:KzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD3pt0uCM0Ej+/dO9fRQvffQBfFT:5qJogYkcSNm9V7D5NuEBfWf4BfFT
Score

10^/10

ransomware spyware stealer
- Renames multiple (8883) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2