lockbit

General

Target

Lockbit-Ransomware-Builder-main (1).zip
Size

283KB
Sample

241127-xdafsavpcz
MD5

0f4c1f0cbe1e3ad1b4fdb0f8de101938
SHA1

c7edeff3353e58c4133fb456d17ac6593c1882c4
SHA256

7f899996d4bc193a1739b8f9ca51a7f46a7d41007f472df5622208e2db62b232
SHA512

98793bae94bfb3baff6f3f76d2c9251eee64d5ec305f3b2384b2bf5157872a1cb83809fa4a5fdb40ed4bd14761936ce43a6c3575e17a2c91b6df7319db06ecbc
SSDEEP

6144:eW+LYvU1+OsOtX2lUFW+LYvU1+OsOtX2lUpW+LYvU1+OsOtX2lUK:WeItX2l2eItX2lUeItX2l9

Score

10^/10

Malware Config

Targets

- Target
  
  Lockbit-Ransomware-Builder-main (1).zip
- Size
  
  283KB
- MD5
  
  0f4c1f0cbe1e3ad1b4fdb0f8de101938
- SHA1
  
  c7edeff3353e58c4133fb456d17ac6593c1882c4
- SHA256
  
  7f899996d4bc193a1739b8f9ca51a7f46a7d41007f472df5622208e2db62b232
- SHA512
  
  98793bae94bfb3baff6f3f76d2c9251eee64d5ec305f3b2384b2bf5157872a1cb83809fa4a5fdb40ed4bd14761936ce43a6c3575e17a2c91b6df7319db06ecbc
- SSDEEP
  
  6144:eW+LYvU1+OsOtX2lUFW+LYvU1+OsOtX2lUpW+LYvU1+OsOtX2lUK:WeItX2l2eItX2lUeItX2l9
Score

10^/10

lockbit defense_evasion discovery ransomware spyware stealer
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Lockbit family
  lockbit
- Rule to detect Lockbit 3.0 ransomware Windows payload
- Renames multiple (594) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2