General

  • Target

    ff76ba016e70524e9c5016e0bd55ec7f57ebe654dbe3f9fc438cad9be9e63560.rar

  • Size

    281KB

  • Sample

    240904-py3zts1gqa

  • MD5

    c36beb946f186f7fc542697da6c705bf

  • SHA1

    2e00f1ca70fe97e95ca4bd9d1cee674533123653

  • SHA256

    ff76ba016e70524e9c5016e0bd55ec7f57ebe654dbe3f9fc438cad9be9e63560

  • SHA512

    5a2bd1335955e8b1b84c97ea39b4274a3405499c1d76bec1459628787995df86dbc3d3ed60dcf07d0618eed3b1523bf53b647605a71bcba5e06d90d9547a1577

  • SSDEEP

    6144:fQJCr0LvrmHyQuQTOyiNzzSrNTaIiaR0Xv4/WIHudPq14VBa:fQ0+vyHs8ipzSr9cGUvRXd7w

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://master-repogen.vercel.app/file/server.scr

Extracted

Path

C:\wlJ8FiR2h.README.txt

Family

lockbit

Ransom Note
~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom DeathGrip Ransomware Attack | t.me/DeathGripRansomware This computer is attacked by russian ransomware community of professional black hat hackers. Your every single documents / details is now under observation of those hackers. If you want to get it back then you have to pay 1000$ for it. This Attack Is Done By Team RansomVerse You Can Find Us On Telegram @DeathGripRansomware Contact The Owner For The Decrypter Of This Ransomware #DeathGripMalware >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. You can obtain information about us on Telegram t.me/DeathGripRansomware >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using on Telegram messenger without registration and text t.me/DeathGripRansomware Using Tox messenger, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, write in jabber or tox. If this contact is expired, and we do not respond you, look for the relevant contact data on our website via Tor or Brave browser Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
URLs

http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion

http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion

http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion

http://lockbitsupp.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

Targets

    • Target

      private server/death.‮gpj.scr

    • Size

      466KB

    • MD5

      0fdbc8c24e84eea10dc25e81765014a1

    • SHA1

      2d566a2b94fc8b16b97200392db1bbe714c31289

    • SHA256

      e173dd358ec750f561ec4eec0c6d75e8709bc32fbe43a5e9a92dd0db96c82b58

    • SHA512

      3cb0c09cc5303f7842fd5ba79a118f62586c4f494a2168c6103db55697fe9dc063f866ec5ee8fc208e01cfe7d7e6b044847c824ee28ed7b4ba41d035fb7da72f

    • SSDEEP

      12288:CgZXEAO/BUdG3gVdt7Kdm5bakhM/7xah42prW1:CgZXoZUTVdt7K0JakhM1ah42prW1

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

    • Rule to detect Lockbit 3.0 ransomware Windows payload

    • Renames multiple (603) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks