lockbit | 8cdabda0c32376426e32048c867b7d66d9df6a3f0da53baef67e1a30abd444b7

General

Target

2024-09-24_8f07589938ea42db794ebef25c755965_darkside
Size

147KB
Sample

240924-c4vjeswflc
MD5

8f07589938ea42db794ebef25c755965
SHA1

aa6f9576dfc56a6fccb37d9e70ed0bb441e084e8
SHA256

8cdabda0c32376426e32048c867b7d66d9df6a3f0da53baef67e1a30abd444b7
SHA512

79e553062ea5e4de34245bc9e8e6a26db2823cd12d51995e401ebfe47ece36a0a7819a2cad79bf14894a1ca30c9a3587a6101b7e8c3ae1432351deebe8fd86e8
SSDEEP

1536:ZzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDYediJW5QdpkLMuAkHiWIlqUyz:iqJogYkcSNm9V7DFEW5QAQrRW2qT

Score

10^/10

Malware Config

Extracted

Path

C:\LOyx4shPX.README.txt

Ransom Note

######################################################################################## YOUR COMPANY NETWORK HAS BEEN PENETRATED All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. YOUR PERSONAL ID: BtVU0r1vpQsdlbLPcJmi8jToR3hqNAaz6fZuMx9gH5kyEOwXYG2KeCFn Contact us, use the email: [email protected] [email protected] IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.

Emails

[email protected]

Targets

- Target
  
  2024-09-24_8f07589938ea42db794ebef25c755965_darkside
- Size
  
  147KB
- MD5
  
  8f07589938ea42db794ebef25c755965
- SHA1
  
  aa6f9576dfc56a6fccb37d9e70ed0bb441e084e8
- SHA256
  
  8cdabda0c32376426e32048c867b7d66d9df6a3f0da53baef67e1a30abd444b7
- SHA512
  
  79e553062ea5e4de34245bc9e8e6a26db2823cd12d51995e401ebfe47ece36a0a7819a2cad79bf14894a1ca30c9a3587a6101b7e8c3ae1432351deebe8fd86e8
- SSDEEP
  
  1536:ZzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDYediJW5QdpkLMuAkHiWIlqUyz:iqJogYkcSNm9V7DFEW5QAQrRW2qT
Score

10^/10

defense_evasion discovery ransomware
- Renames multiple (181) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
- Executes dropped EXE
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1