lockbit | 6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417

General

Target

6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417
Size

147KB
Sample

240626-j5k5psvckf
MD5

9c5698924d4d1881efaf88651a304cb3
SHA1

c60a0b99729eb6d95c2d9f8b76b9714411a3a751
SHA256

6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417
SHA512

1e9cc0d7c831a496e3dbcc56f2d5d477e7a7546c2f223b0278fedfa10fc1bebb0412fd5d81ac02a77aa503ddc99dea1d59d9120d076ae7a0f5137c9260a64eea
SSDEEP

3072:+6glyuxE4GsUPnliByocWepMT0CY2gbP39m3Lpdp:+6gDBGpvEByocWeAYTbPN8p

Score

10^/10

Malware Config

Extracted

Path

C:\flzQgniJJ.README.txt

Ransom Note

*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: uYrTA6hpRFsWQR0nqlFk5WK8S+zUIHNd9T3L6aykdR27ztPJwC3xHOsdSBkZhmr+yKcnVLCct0ffjVRy5yvFQydzhzQWJR Email to support: [email protected]

Emails

[email protected]

URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Targets

- Target
  
  6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417
- Size
  
  147KB
- MD5
  
  9c5698924d4d1881efaf88651a304cb3
- SHA1
  
  c60a0b99729eb6d95c2d9f8b76b9714411a3a751
- SHA256
  
  6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417
- SHA512
  
  1e9cc0d7c831a496e3dbcc56f2d5d477e7a7546c2f223b0278fedfa10fc1bebb0412fd5d81ac02a77aa503ddc99dea1d59d9120d076ae7a0f5137c9260a64eea
- SSDEEP
  
  3072:+6glyuxE4GsUPnliByocWepMT0CY2gbP39m3Lpdp:+6gDBGpvEByocWeAYTbPN8p
Score

10^/10

ransomware spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2