8da728a03e795aa9fb0aa4613759d6bdb10797107dcfb0bb23253514f890a062

General

Target
SecuriteInfo.com.Win32.MalwareX-gen.23527.20110.exe
Size 5.5MB
Sample240810-vzv89stekd
SHA256 8da728a03e795aa9fb0aa4613759d6bdb10797107dcfb0bb23253514f890a062
MD5 81ee3f681043fedf57e73b20e6c3cf02
SHA1 17b78ad12b1ae1c037c5d39dbe7aa0e7de4ec809
SHA512 86b0204e9d3f340ca921afba124df09c1938f4668a4ed6e8d8c33224697af98012b8c5f3ab7ebd7f1e6d21903b504dd06496af503581e09d28ad5fb7afc10387
SSDEEP 98304:RBk5YfWV/DgIDf7LJzShceZVH3Strvi5/iu86hmfPyBDOlEEub3JUM:TknV/D0hJVHipsiu86hm32DOlEEkZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\tbHU4R71K.README.txt

Ransom Note

~~~ LockBit 5.08 the world's fastest ransomware since 2024~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom BTC amount 0.02 BTC amount 0 , deleted all files from you PC, and post all infirmation to public. where send BTC: bc1q3jwsuxq572pucdcdytd420fvsvysmn2dquh0mk You can buy them on the exchange or at an ATM https://coinatmradar.com. You can find the addresses here buy with credit or debet card online https://www.moonpay.com/buy. After that, send a request with confirmation to e-mail , faster way! [email protected] or [email protected] If both email no answer, you need faster answer and unlock please use TOX You can contact us using Tox messenger without registration and SMS https://tox.chat/download.html. Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, tox. Tox ID LockBitSupp: 47C90F99E92AC0ECEAD8C2BD15B21866EBC1195B6E2B0412CE3658E21B696843FF4A8D144B24

Emails

URLs

https://coinatmradar.com
https://www.moonpay.com/buy
https://tox.chat/download.html

Targets

- Target
  SecuriteInfo.com.Win32.MalwareX-gen.23527.20110.exe
- Size 5.5MB
- SHA256 8da728a03e795aa9fb0aa4613759d6bdb10797107dcfb0bb23253514f890a062
- MD5 81ee3f681043fedf57e73b20e6c3cf02
- SHA1 17b78ad12b1ae1c037c5d39dbe7aa0e7de4ec809
- SHA512 86b0204e9d3f340ca921afba124df09c1938f4668a4ed6e8d8c33224697af98012b8c5f3ab7ebd7f1e6d21903b504dd06496af503581e09d28ad5fb7afc10387
- SSDEEP 98304:RBk5YfWV/DgIDf7LJzShceZVH3Strvi5/iu86hmfPyBDOlEEub3JUM:TknV/D0hJVHipsiu86hm32DOlEEkZ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

credential_access defense_evasion discovery ransomware spyware stealer
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Renames multiple (326) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2