lockbit | 1ea8c04497c684c1337e4902bf8edf3fbe632d1775286243e1e6bbba759402b8

General

Target

2024-09-08_0b14554861845d417fc0cdc27bec8019_darkside
Size

147KB
Sample

240908-aq5q5awdra
MD5

0b14554861845d417fc0cdc27bec8019
SHA1

811042a7614a890dd332603476b1a27fef528518
SHA256

1ea8c04497c684c1337e4902bf8edf3fbe632d1775286243e1e6bbba759402b8
SHA512

771707df51f0a4df2cfe68abc5f730a32452f16625e546c7557917cb356d2284fd58ddea3af678fb7a28b0485493522a5edfdb6a0eafffd34e9f3c8a6cf6a05e
SSDEEP

3072:uqJogYkcSNm9V7DwMN7T8xPy8iuF7snT:uq2kc4m9tDjtTcPyeF

Score

10^/10

Malware Config

Extracted

Path

C:\Yl8SYKvBf.README.txt

Ransom Note

######################################################################################## YOUR COMPANY NETWORK HAS BEEN PENETRATED All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. YOUR PERSONAL ID: Smh5Plj4sMuLkO3gTfv8YqUDwtiRE9Anc2oIdpa6B1CxGX0yKFJ7erWHbQ Contact us, use the email: [email protected] [email protected] IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

[email protected]

Targets

- Target
  
  2024-09-08_0b14554861845d417fc0cdc27bec8019_darkside
- Size
  
  147KB
- MD5
  
  0b14554861845d417fc0cdc27bec8019
- SHA1
  
  811042a7614a890dd332603476b1a27fef528518
- SHA256
  
  1ea8c04497c684c1337e4902bf8edf3fbe632d1775286243e1e6bbba759402b8
- SHA512
  
  771707df51f0a4df2cfe68abc5f730a32452f16625e546c7557917cb356d2284fd58ddea3af678fb7a28b0485493522a5edfdb6a0eafffd34e9f3c8a6cf6a05e
- SSDEEP
  
  3072:uqJogYkcSNm9V7DwMN7T8xPy8iuF7snT:uq2kc4m9tDjtTcPyeF
Score

10^/10

defense_evasion discovery ransomware
- Renames multiple (167) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2