lockbit | 9e1342e551b8eec0a18eb329f1968b9d81023e1152a15702fc901d8d129c16c2

General

Target
lockbit.zip
Size 203KB
Sample240430-sxxcfaaa41
SHA256 9e1342e551b8eec0a18eb329f1968b9d81023e1152a15702fc901d8d129c16c2
MD5 931e705e45ad0a5f0e5845636d03c922
SHA1 e5d04b01cf0089d017a82ffbf69ae8b4acde2a62
SHA512 059454fb084f9af77cb1bdaeed37256517445e52e5978a8bba254763da6623fd074bcf8e10d01cbc3cafa4b2616c735ae4d8a6f28eb9b2c5c0313f03c951374d
SSDEEP 3072:9BXTH5uXDVoKoXsciMGb/Ou/SRzkhNZlcA/WtXRviGkx0jo1VuAXEfq9nygdc3k5:9NQCVipOu/GWNh/EAL0fq92kcK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  lb.exe
- Size 194KB
- SHA256 41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
- MD5 6fd558cf3add096970e15d1e62ca1957
- SHA1 78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23
- SHA512 fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc
- SSDEEP 3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

ransomware spyware stealer
- Renames multiple (317) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  lbb.exe
- Size 194KB
- SHA256 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616
- MD5 e990e7571cdb06c5d0f093176cecf414
- SHA1 409fc0816adbf05ac1586112044401ecb90c8022
- SHA512 9719fb45a0cd79ba8d51c3d052fe76dcb6d1b5b677a5398cc4fdbe6373d8763d2b0c3375929f41c5a0e46237b4a3f660b0b7f6a4f8a24ea47d52074da69baa64
- SSDEEP 3072:A6glyuxE4GsUPnliByocWepzdBaChENI/NBpke:A6gDBGpvEByocWelq+V
- MD5 SHA1 SHA512 SSDEEP
Score

9^/10

ransomware spyware stealer
- Renames multiple (324) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4