lockbit

General

Target

1973ccbab82020881d531ccd1f2ca48e.bin
Size

94KB
Sample

240805-fnb9paxdrr
MD5

89dabe88b04bc34579fef7df13539ba8
SHA1

c3b24e2c4e9b0bac84bdff78c3781d4e49e02693
SHA256

8e7a4b4a29df88ecefcf4a3dd6a22ef616f406c6ed207e6d4819795afeb163c5
SHA512

a2ef4bf6f351707f1b51d616c62684a0ca9014d281e98974ea9f72778fda43bfd5a7b17b6ee91babb3ec54a55bbbd1f76b54f189eda10961fcd5bfd3282d3806
SSDEEP

1536:H6B4axw9uiBA5x9eulET7GGKU0ZjtPZZhvtXbf4kyiTqUfWtrupFbLZ06brmSN:ui+9eu47NAZjtXvbnycpfWt6pbnmSN

Score

10^/10

Malware Config

Extracted

Path

C:\xcEElHqGu.README.txt

Family

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom All of your files have been encrypted! (Warning: Attempting to remove the software will corrupt your hard drives meaning no further use even when wiped. We simply charge $25 which is far cheaper than buying a new drive.) Your computer was infected with a ransomware software. Your files have been encrypted and you won't be able to decrypt them without purchasing $25 BTC. What can I do to get my files back? You will send payment of $25 BTC to gain access to your files again, once payment is made after 3 confirmations on the blockchain (15 mins) your files will be restored and the software will un-install itself from your computer. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment will increase soon to double, be cooperative and your files will be released. Payment information Amount: 0.000385636 BTC Bitcoin Address: bc1qc76qr24pxnms9f93mytfg4dn7ztuvmje7g43dr

Targets

- Target
  
  d20d22dd302f51341405794a8fb3866c234fafe614b67b55934a9a959a4cd847.exe
- Size
  
  147KB
- MD5
  
  1973ccbab82020881d531ccd1f2ca48e
- SHA1
  
  7e18f712e26ea32b0e8aeb4cd3c958eb8d32dfed
- SHA256
  
  d20d22dd302f51341405794a8fb3866c234fafe614b67b55934a9a959a4cd847
- SHA512
  
  67654e67afe6a3e1ddf335dff4b976e254c45d8046853607cb4e98af6cd43accee8f2e35e296b932385bc9a6b7fed96ee4be6e113457eb5eb057bd8301f476f6
- SSDEEP
  
  1536:PzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD8UhzyIccE+72p2Kbm+0ep3PeAM:wqJogYkcSNm9V7D8URMcS0ep3BcTT
Score

10^/10

lockbit defense_evasion discovery ransomware spyware stealer
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Renames multiple (635) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1