lockbit

General

Target

2024-06-20_7021fda2c2246666ad9077f408fc8171_lockbit
Size

862KB
Sample

240620-fla9lszela
MD5

7021fda2c2246666ad9077f408fc8171
SHA1

2493affe8c14d21c741c8fd45d4b94358c543dc2
SHA256

1b2176a06a4ba25c4a15a3a2b1da83bc7abe078a76892ba14c2a2f95a9c10d48
SHA512

fcc558870d05c0b3cee10f8d69f20d10bdfd9039e0b64036156d3d0dd45f69933b0c89d687095d8c9eb62ea5914954ceb58a0c12fef14740447d176486a02c6f
SSDEEP

24576:7xAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QHF:1AfSrWW4g+7Ht+UmxJeU

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\DVD Maker\de-DE\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 46EEB1A043A8ECAAC9FA67223AD74AE6

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 46EEB1A043A8ECAAF62CCC927CB0FDBB

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Targets

- Target
  
  2024-06-20_7021fda2c2246666ad9077f408fc8171_lockbit
- Size
  
  862KB
- MD5
  
  7021fda2c2246666ad9077f408fc8171
- SHA1
  
  2493affe8c14d21c741c8fd45d4b94358c543dc2
- SHA256
  
  1b2176a06a4ba25c4a15a3a2b1da83bc7abe078a76892ba14c2a2f95a9c10d48
- SHA512
  
  fcc558870d05c0b3cee10f8d69f20d10bdfd9039e0b64036156d3d0dd45f69933b0c89d687095d8c9eb62ea5914954ceb58a0c12fef14740447d176486a02c6f
- SSDEEP
  
  24576:7xAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QHF:1AfSrWW4g+7Ht+UmxJeU
Score

10^/10

lockbit discovery persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Deletes itself
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2