lockbit | e15032dd5c14a1149274faf83ed306ab82fa0d90aa507c982025d4e2d32098c3

General

Target

Venom Software v6.zip
Size

94KB
Sample

240523-v5vjxsaf78
MD5

8533fed20b64766a46d12a2154c51449
SHA1

f12b6544e3ddb41439bdfcc0ff8422d6372a1276
SHA256

e15032dd5c14a1149274faf83ed306ab82fa0d90aa507c982025d4e2d32098c3
SHA512

2c5e7adea1067def2a24b12a7d3365b0df558c6c40424d1a0de2d1d585aeffc735b7ae3f39c5454a5a31bf1e6df05f7531a31328d4c2683423137173bbfebfd4
SSDEEP

1536:1r0cg/+qa/ml1JvtOHawhwfz+lhq2whbQnpGs7A7fV/0+G/Inskwp4ektWmJFinn:1rlXPml1jOHwzWQwYsM7fs/OlektVFin

Score

10^/10

Malware Config

Extracted

Path

C:\3R9qG8i3Z.README.txt

Ransom Note

~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FC71B581D039F476B7 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.

URLs

https://t.me/mr_robot_unlock

Extracted

Path

C:\3R9qG8i3Z.README.txt

Ransom Note

~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FC613271855F60B2DD >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.

URLs

https://t.me/mr_robot_unlock

Extracted

Path

C:\3R9qG8i3Z.README.txt

Ransom Note

~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FC33405A166AE44C89 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.

URLs

https://t.me/mr_robot_unlock

Extracted

Path

C:\3R9qG8i3Z.README.txt

Ransom Note

~~~ PC Locker 3.0 by Mr.Robot~~~ >>>> Your data are stolen and encrypted To get your files back you will have to pay a one-time fee of $45 in bitcoin or monero. >>>> You need contact us and decrypt one file for free on these platforms with your personal DECRYPTION ID Contact the following account on telegram @mr_robot_unlock or paste this link in your browser https://t.me/mr_robot_unlock >>>> Your personal DECRYPTION ID: 4B75BFA39AA770FC9A485144C1CB3E21 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom you will not receive you files NO EXCEPTIONS! >>>> Warning! Any attempt to negotiate or you don't want to pay is INSTANT BLOCK! >>>> Advertisement Would you like to earn thousands of dollars $$$ ? We sell mentorship for stealers, DDOS and ransomware. We only work with professionals and people with money DO NOT WASTE OUR TIME.

URLs

https://t.me/mr_robot_unlock

Targets

- Target
  
  Venom Software v6/VenomV6.exe
- Size
  
  146KB
- MD5
  
  3d49478072bf18339ef810c8ea7546b2
- SHA1
  
  c1047d72d4cdce21af4bb989ad1bee437edb7f80
- SHA256
  
  e3300e30997c5a355f02ca6972711b2ca843d00a393b62c75818a43c27ff128d
- SHA512
  
  f47f6a1c51b92cc34a1dc264bc2b151690f1c314c5f97b08530e9efd6929c860985f9410f411cb31e0f3acd75b8969e4791ca9fb080901f6f4cb70322255a91c
- SSDEEP
  
  3072:A6glyuxE4GsUPnliByocWepU0DxwbL2LUnPaZw:A6gDBGpvEByocWeTDxOL2LScw
Score

10^/10

ransomware spyware stealer
- Renames multiple (324) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2 behavioral3 behavioral4