lockbit | 3c13ae9a53b29849fd3bb75d3259a23658cd687441f8bdd610487007c51d2eac

General

Target

2024-07-31_11c051782c327c662507801124f0b95b_darkside
Size

147KB
Sample

240731-mf5plasfrf
MD5

11c051782c327c662507801124f0b95b
SHA1

5dd92a1ab1cfc5b73b5dcdb3edd6ea6d498339df
SHA256

3c13ae9a53b29849fd3bb75d3259a23658cd687441f8bdd610487007c51d2eac
SHA512

239f6eba567c59cf956e4f6c8ffe6588bb2b16ede03e939f79db69ae23631881285475f634780a40f94038035fb1329743c9b57c92a9690ec927f6d372d9ca2e
SSDEEP

1536:GzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDuc1UR7zBEDZhT+IhMjo9Uyz:9qJogYkcSNm9V7DJ1URfqVXmjo9T

Score

10^/10

Malware Config

Extracted

Path

C:\d093fD6aI.README.txt

Ransom Note

~~~ LockBit 5.01 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom BTC amount 0.01 = up to 12hr BTC amount 0.02 = up to 24hr BTC amount 0.1 = up 48 hr BTC amount 0 , deleted all files from you PC, and post all infirmation to public. where send BTC: bc1qm7sg7p2jkgthv7pkjy856sh9lr5x3yrpzv099d :not valid after 07/23/2024 10PM EST. Time just 12 hr, after everythink will be removed You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. You have 12 hours for the transfer, 24 hours for the amount of 0.02, and of course, you can always wait 48 hours and pay 0.1. After that, send a request with confirmation to TOX , faster way! You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, tox. Tox ID LockBitSupp: B90F5C1EC3C13400F6D0B22B772C5FAB086F8C41A0C87B92A8B3C7F2ECBBCE191A455140273E

URLs

https://coinatmradar.com

https://www.moonpay.com/buy

https://tox.chat/download.html

Targets

- Target
  
  2024-07-31_11c051782c327c662507801124f0b95b_darkside
- Size
  
  147KB
- MD5
  
  11c051782c327c662507801124f0b95b
- SHA1
  
  5dd92a1ab1cfc5b73b5dcdb3edd6ea6d498339df
- SHA256
  
  3c13ae9a53b29849fd3bb75d3259a23658cd687441f8bdd610487007c51d2eac
- SHA512
  
  239f6eba567c59cf956e4f6c8ffe6588bb2b16ede03e939f79db69ae23631881285475f634780a40f94038035fb1329743c9b57c92a9690ec927f6d372d9ca2e
- SSDEEP
  
  1536:GzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDuc1UR7zBEDZhT+IhMjo9Uyz:9qJogYkcSNm9V7DJ1URfqVXmjo9T
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (329) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2