lockbit | cf6305a67821101a2613f779dfb463a776b2353f0fe81ceeaf1c5c70039e5d7b | Triage

Sharing

General

Target

cf6305a67821101a2613f779dfb463a776b2353f0fe81ceeaf1c5c70039e5d7b
Size

147KB
Sample

240920-ex212ayelm
MD5

fd68012fa7c5c63d393aa44b039cd193
SHA1

62084644f50562eefc223c0b505f77ba1d953e5e
SHA256

cf6305a67821101a2613f779dfb463a776b2353f0fe81ceeaf1c5c70039e5d7b
SHA512

98d00d758303473040a509ffecf938a976702707fa1fb8ef98f8b2df4ef9ce7ef2ff714a11f1284bfff31a9edb62144f797cddff24394faded5e156fbe475077
SSDEEP

1536:CzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDYM3UFLzhoDGBxkFQBoBml6ziNS:BqJogYkcSNm9V7DDENzyqxkbml6BbBT

Score

10^/10

lockbit discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  cf6305a67821101a2613f779dfb463a776b2353f0fe81ceeaf1c5c70039e5d7b
- Size
  
  147KB
- MD5
  
  fd68012fa7c5c63d393aa44b039cd193
- SHA1
  
  62084644f50562eefc223c0b505f77ba1d953e5e
- SHA256
  
  cf6305a67821101a2613f779dfb463a776b2353f0fe81ceeaf1c5c70039e5d7b
- SHA512
  
  98d00d758303473040a509ffecf938a976702707fa1fb8ef98f8b2df4ef9ce7ef2ff714a11f1284bfff31a9edb62144f797cddff24394faded5e156fbe475077
- SSDEEP
  
  1536:CzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDYM3UFLzhoDGBxkFQBoBml6ziNS:BqJogYkcSNm9V7DDENzyqxkbml6BbBT
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (351) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer