lockbit

General

Target

2024-07-09_819e99fcbe582443daf3dc7605bdba4e_darkside
Size

147KB
Sample

240709-xp91sazdpp
MD5

819e99fcbe582443daf3dc7605bdba4e
SHA1

1ca7a6d96ad09704adf068b34848e3db9aafe4f0
SHA256

76bab2ddaa0159d1a379e896581dca9675f1ef51bf31194fd4e85ab06ad75562
SHA512

62aeab27b40dd7a6b7e3f981911c750a056fcad247ad40fe470dbe94bf07d0a186a01dfdc1eb81f9ae78dd7eb2b724214eb87948ed1f8579c4f74b75611ee4ea
SSDEEP

3072:K6glyuxE4GsUPnliByocWep3QqGp3VeTBAPpk2pjPdZ8Y:K6gDBGpvEByocWeOqG/5kiPdZ8

Score

10^/10

Malware Config

Extracted

Path

C:\1VDsMQg1G.README.txt

Family

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom CONTACT US AT Telegram:@anon3621 Chat Link:t.me/anon3621 >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID:92361C35E31C9012FBC19BCA4F120F069CB80 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay in 48H we will publish all your data to the dark web! >>>> Payment amount is 25$ only at once >>>> BTC: 1HBg3gNYrqLGDoXyxBEsakTwodUzP3xje >>>> ETH: 0x1330e56e0051ad34a21ac06d84dceb48cf55db62 >>>> USDT: TC5K4qWnM5Y1GBHTfTMemGLmRVuTGNs61K

Wallets

1HBg3gNYrqLGDoXyxBEsakTwodUzP3xje

Extracted

Path

C:\1VDsMQg1G.README.txt

Family

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom CONTACT US AT Telegram:@anon3621 Chat Link:t.me/anon3621 >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID:92361C35E31C9012FBC196004302B30B8313E >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay in 48H we will publish all your data to the dark web! >>>> Payment amount is 25$ only at once >>>> BTC: 1HBg3gNYrqLGDoXyxBEsakTwodUzP3xje >>>> ETH: 0x1330e56e0051ad34a21ac06d84dceb48cf55db62 >>>> USDT: TC5K4qWnM5Y1GBHTfTMemGLmRVuTGNs61K

Wallets

1HBg3gNYrqLGDoXyxBEsakTwodUzP3xje

Targets

- Target
  
  2024-07-09_819e99fcbe582443daf3dc7605bdba4e_darkside
- Size
  
  147KB
- MD5
  
  819e99fcbe582443daf3dc7605bdba4e
- SHA1
  
  1ca7a6d96ad09704adf068b34848e3db9aafe4f0
- SHA256
  
  76bab2ddaa0159d1a379e896581dca9675f1ef51bf31194fd4e85ab06ad75562
- SHA512
  
  62aeab27b40dd7a6b7e3f981911c750a056fcad247ad40fe470dbe94bf07d0a186a01dfdc1eb81f9ae78dd7eb2b724214eb87948ed1f8579c4f74b75611ee4ea
- SSDEEP
  
  3072:K6glyuxE4GsUPnliByocWep3QqGp3VeTBAPpk2pjPdZ8Y:K6gDBGpvEByocWeOqG/5kiPdZ8
Score

10^/10

lockbit ransomware spyware stealer
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Renames multiple (9074) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2