lockbit

General

Target

2e5d02c8ae01a8f66eacdb81a8ff1203dbed3a66
Size

146KB
Sample

240704-lfx43swgjg
MD5

940bdaaaf565a64839aa869ddc4b95ae
SHA1

2e5d02c8ae01a8f66eacdb81a8ff1203dbed3a66
SHA256

0bbd59147cf0893d16829d705dcb6bed82487efc77c78fb17c1f2dcffa08875e
SHA512

10ff50e837725dea0dd1ea67153120455853dacca6e5b330197c81101161c96bdfbc2a84c245cfa24a86786f4851d1bdd184515fcf42e7de8e0b6e63a09f691c
SSDEEP

3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\DVD Maker\it-IT\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?8035FC5C99ED2F24A221F4C83EF12936 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?8035FC5C99ED2F24A221F4C83EF12936 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?8035FC5C99ED2F24A221F4C83EF12936

http://lockbitks2tvnmwk.onion/?8035FC5C99ED2F24A221F4C83EF12936

Extracted

Path

C:\Users\Admin\Desktop\LockBit-note.hta

Ransom Note

Lock BIT Any attempts to restore your files with the thrid-party software will be fatal for your files! Restore you data posible only buying private key from us. There is only one way to get your files back: Through a standard browser Open link - http://lockbit-decryptor.top/?8035FC5C99ED2F24A221F4C83EF12936 Follow the instructions on this page Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?8035FC5C99ED2F24A221F4C83EF12936 This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?8035FC5C99ED2F24A221F4C83EF12936

http://lockbitks2tvnmwk.onion/?8035FC5C99ED2F24A221F4C83EF12936

Extracted

Path

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Restore-My-Files.txt

Family

lockbit

Ransom Note

All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?8035FC5C99ED2F24A9701DB3C6305BEE | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?8035FC5C99ED2F24A9701DB3C6305BEE This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about

URLs

http://lockbit-decryptor.top/?8035FC5C99ED2F24A9701DB3C6305BEE

http://lockbitks2tvnmwk.onion/?8035FC5C99ED2F24A9701DB3C6305BEE

Targets

- Target
  
  2e5d02c8ae01a8f66eacdb81a8ff1203dbed3a66
- Size
  
  146KB
- MD5
  
  940bdaaaf565a64839aa869ddc4b95ae
- SHA1
  
  2e5d02c8ae01a8f66eacdb81a8ff1203dbed3a66
- SHA256
  
  0bbd59147cf0893d16829d705dcb6bed82487efc77c78fb17c1f2dcffa08875e
- SHA512
  
  10ff50e837725dea0dd1ea67153120455853dacca6e5b330197c81101161c96bdfbc2a84c245cfa24a86786f4851d1bdd184515fcf42e7de8e0b6e63a09f691c
- SSDEEP
  
  3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc
Score

10^/10

lockbit defense_evasion evasion execution impact persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (9324) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2