lockbit | 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86 | Triage

Sharing

General

Target

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe
Size

145KB
Sample

240530-yszjwsha5t
MD5

76b23dd72a883d8b1302bb4a514b7967
SHA1

338e19e8a3615c29d8a825ebba66cf55fa0caa2c
SHA256

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86
SHA512

39d98f914ec9d8551a894306163bc726f035f9228f3f198de78555988cea5a7b423be8c2a19913c76b996220a81a9b3a257b7f0af67913aa8a50b77321b17735
SSDEEP

1536:azICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtCYU0GsvgtwjECrozUYj3PeAU2:pqJogYkcSNm9V7DtCCGsg+AmYylQhTT

Score

10^/10

lockbit ransomware spyware stealer

Malware Config

Targets

- Target
  
  311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe
- Size
  
  145KB
- MD5
  
  76b23dd72a883d8b1302bb4a514b7967
- SHA1
  
  338e19e8a3615c29d8a825ebba66cf55fa0caa2c
- SHA256
  
  311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86
- SHA512
  
  39d98f914ec9d8551a894306163bc726f035f9228f3f198de78555988cea5a7b423be8c2a19913c76b996220a81a9b3a257b7f0af67913aa8a50b77321b17735
- SSDEEP
  
  1536:azICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtCYU0GsvgtwjECrozUYj3PeAU2:pqJogYkcSNm9V7DtCCGsg+AmYylQhTT
Score

9^/10

ransomware spyware stealer
- Renames multiple (337) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ransomwarespywarestealer

behavioral2

ransomwarespywarestealer