lockbit | 56b370f9b02c4aa27c815e97797e1e21638f0cf032d5cffaf21bf8223a64c01b

General

Target

LB3.exe
Size

147KB
Sample

240705-ty1a6atgke
MD5

784ce1cab14588f385b179f9606009eb
SHA1

b57f0bad0ec1d3ca1b90d892252f829d9683d33a
SHA256

56b370f9b02c4aa27c815e97797e1e21638f0cf032d5cffaf21bf8223a64c01b
SHA512

7ec7614e08dd9a69d9184b9efa37fcfa6828b57cd1f65538b88edf6379540ec2bc5ebc53f9b0a89444d793433277aaedc47cef69b417a00d1bc3f153d77f4c31
SSDEEP

3072:D6glyuxE4GsUPnliByocWep0vTsjforRRk4dzW:D6gDBGpvEByocWeevwzikw

Score

10^/10

Malware Config

Extracted

Path

C:\MGCjxqq8r.README.txt

Ransom Note

~~~ XdrZaman Ransomware ~~~ >>>> Your data are stolen and encrypted You need to pay 100$ to this address BTC: bc1qx3qwft3t3dc4rcke0e8lrhtxrkp5xq5nf3xktr The data will be published on TOR website if you do not pay the ransom >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Tox ID LockBitSupp: CA5F6002ABA4DB818F89143499F9CF833E0FFB1D174E837FB2881D4576B0160693307E7564A2 >>>> Your personal DECRYPTION ID: DF03BF5536BD458F420CC8A34DC2F708 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Targets

- Target
  
  LB3.exe
- Size
  
  147KB
- MD5
  
  784ce1cab14588f385b179f9606009eb
- SHA1
  
  b57f0bad0ec1d3ca1b90d892252f829d9683d33a
- SHA256
  
  56b370f9b02c4aa27c815e97797e1e21638f0cf032d5cffaf21bf8223a64c01b
- SHA512
  
  7ec7614e08dd9a69d9184b9efa37fcfa6828b57cd1f65538b88edf6379540ec2bc5ebc53f9b0a89444d793433277aaedc47cef69b417a00d1bc3f153d77f4c31
- SSDEEP
  
  3072:D6glyuxE4GsUPnliByocWep0vTsjforRRk4dzW:D6gDBGpvEByocWeevwzikw
Score

10^/10

ransomware spyware stealer
- Renames multiple (452) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1