Overview

overview

10

Static

static

10

Lockbit4.exe

windows7-x64

10

Lockbit4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Lockbit4.zip

  • Size

    93KB

  • Sample

    240328-qswt1afc61

  • MD5

    cbfa130416e1cd2a0ddf457e635d9c3d

  • SHA1

    e16a5d32dea354085cd845f9ab8b3d778f890cb4

  • SHA256

    e4bd46ed9c588b369dc6cbaa9d8dd61d59424b677e4724aa7bbe4dc83b170f92

  • SHA512

    80f9e8c3934a37941387ecbf79c130a5cfbd8169606bc6f9f35e143e9d4309dc06fd4383c20ed96c9d988246ba347beb11e3707f109674cc07ba86a392fcc735

  • SSDEEP

    1536:QURyj38t1eValnHfpPEiNZh+hBtk/yJFhR+N+Z7+/ZyNkR7jk/8bXEAoVlLNNS:hY38t1GSfpEKGIyThRJ7jeF48b0NVlLm

Score
10/10
lockbitransomwarespywarestealer

Malware Config

Extracted

Path

C:\xa1Xx3AXs.README.txt

Ransom Note
~~~ LockBit 4.0 Ransomware since 2024~~~ >>>> Your data are stolen and encrypted Price = 1000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = jimyjoy139@proton.me >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: A3138014A48684D6D525F3F372263313 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
Emails

jimyjoy139@proton.me

Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Targets

    • Target

      Lockbit4.exe

    • Size

      146KB

    • MD5

      e544b3593a6441f9654839e11aa0bea5

    • SHA1

      f7d5e39e1b031002887b4a7d8a8ef889c892c3e7

    • SHA256

      9b5f1ec1ca04344582d1eca400b4a21dfff89bc650aba4715edd7efb089d8141

    • SHA512

      9c6f2a04307b0a41e9aaf7c9c68dd901787d7ad65e80f293893c21e026e2de11b729b0fdbeb0c0926214e85d9b4c3473e94017be2e0fb49ed5a91fdff7ca9e83

    • SSDEEP

      1536:KzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD3pt0uCM0Ej+/dO9fRQvffQBfFT:5qJogYkcSNm9V7D5NuEBfWf4BfFT

    Score
    10/10
    ransomwarespywarestealer

    • Renames multiple (8926) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks