lockbit

General

Target

52d2af9a8ff6137ac140d31715644d479bf91078969a3884273575e765b51b99
Size

247KB
Sample

240925-w6jz9azhnl
MD5

181190d05df51b957a5f095decd4343d
SHA1

739f87c702abd93600766b00c607761dda8213bf
SHA256

52d2af9a8ff6137ac140d31715644d479bf91078969a3884273575e765b51b99
SHA512

5b086ea903d9d9f714ca972379eedbb3f6d4a35bb474d1f47efeb174a1d1eb8aee0a4279ff28e24907f4c4a00d2283f60babac1f9ac9c59f69f9e47b8a5b4741
SSDEEP

6144:p9l6TO4vGER8FAEx9qDf6LLskJ42K/mJRDQCNPCM:iOOGRaExJfskJ42amJ+CZd

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\DVD Maker\de-DE\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 7D68A5BFD028A31FA9E6B15E2078B020

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Path

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Restore-My-Files.txt

Ransom Note

LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: 7D68A5BFD028A31F4DDA51A204C68F69

URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Targets

- Target
  
  LockBIT_7D68A5BFD028A31F.exe
- Size
  
  862KB
- MD5
  
  4d66e5d97d69602b5f7f456a4c11cf2b
- SHA1
  
  70ae4cb2a3af39a97dc75e0d4937c88faf6dc914
- SHA256
  
  50ac767d5b007b120db7a476126a88f37edc3f54bae24ed546a80477836252ed
- SHA512
  
  e035da06a3c154a6ff0cadddfb559b5d6679e858ae6ffcfc48f8f4f0a8469221222fcf0ca160e24cfdf8f658f48d6484b5baff034a7ab73d5b87fbf964f03fd9
- SSDEEP
  
  24576:DxAf2NuubB6RWspgjuwu7pl4Ha+UmxJH+QzFR:dAfSrWW4g+7Ht+UmxJeg3
Score

10^/10

lockbit discovery persistence ransomware
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2