lockbit | bb176c4f2cbbe4f80f3efcde3121d0ec79a2c05f9825f20445cd0b34aa05e483 | Triage

Sharing

General

Target

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.zip
Size

92KB
Sample

241106-hcksssvmfs
MD5

c9f3e288b89dbf86e80a3e50de0373e7
SHA1

516eceaa0ec1d9e9761e6cb5ca47ad8d2252c013
SHA256

bb176c4f2cbbe4f80f3efcde3121d0ec79a2c05f9825f20445cd0b34aa05e483
SHA512

14c78d7781c8bf190a87682c7fb50d3246b39c168d9b686f8c07463d6de0070910eb1bdf01835f3380c4a4f7bfebd1678bcf5332a294b3b2a2e4d49151716e2d
SSDEEP

1536:rPl7hGyC0AvYCLgAll8xTPncLzkKkUhpwc7783SU1qXk9PoDSAEi1uoQq+vmRV3:rPlFGyaVLgAlI2YKNhpwc7I3SUgkmDSw

Score

10^/10

lockbit discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe
- Size
  
  145KB
- MD5
  
  76b23dd72a883d8b1302bb4a514b7967
- SHA1
  
  338e19e8a3615c29d8a825ebba66cf55fa0caa2c
- SHA256
  
  311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86
- SHA512
  
  39d98f914ec9d8551a894306163bc726f035f9228f3f198de78555988cea5a7b423be8c2a19913c76b996220a81a9b3a257b7f0af67913aa8a50b77321b17735
- SSDEEP
  
  1536:azICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtCYU0GsvgtwjECrozUYj3PeAU2:pqJogYkcSNm9V7DtCCGsg+AmYylQhTT
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (332) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer