lockbit | 67ac70fd9cadf9bf5c827313d444cd3b3d28dfc8f86a7150bd990ab87b634418 | Triage

Sharing

General

Target

2024-08-24_819b75101c9275a3bb120a774b8fb7bd_darkside
Size

145KB
Sample

240824-h87bns1ekn
MD5

819b75101c9275a3bb120a774b8fb7bd
SHA1

56c077ced059f088ffe01dee50420f10c89b7441
SHA256

67ac70fd9cadf9bf5c827313d444cd3b3d28dfc8f86a7150bd990ab87b634418
SHA512

61c5025f6527b38aa7062ea2bb8cb6d46d4fadeb0e8cc19766fdf9f8161f5e35818123e10567803f468120cbc2b0a685d8113c9b357aa9798bd70b0e39b8a388
SSDEEP

3072:cqJogYkcSNm9V7DuUdq8Xv9SYYZeJ1hm3wE2fyT:cq2kc4m9tDJvBYi8

Score

10^/10

lockbit discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  2024-08-24_819b75101c9275a3bb120a774b8fb7bd_darkside
- Size
  
  145KB
- MD5
  
  819b75101c9275a3bb120a774b8fb7bd
- SHA1
  
  56c077ced059f088ffe01dee50420f10c89b7441
- SHA256
  
  67ac70fd9cadf9bf5c827313d444cd3b3d28dfc8f86a7150bd990ab87b634418
- SHA512
  
  61c5025f6527b38aa7062ea2bb8cb6d46d4fadeb0e8cc19766fdf9f8161f5e35818123e10567803f468120cbc2b0a685d8113c9b357aa9798bd70b0e39b8a388
- SSDEEP
  
  3072:cqJogYkcSNm9V7DuUdq8Xv9SYYZeJ1hm3wE2fyT:cq2kc4m9tDJvBYi8
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (383) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer