lockbit | 8bedd5cf2d48da4f1533ffdd999dd62f48a49a97d16ee67ee837caa9dd2d7d33 | Triage

Sharing

General

Target

2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside
Size

145KB
Sample

241205-v2h2qazrhk
MD5

70c964b9aeac25bc97055030a1cfb58a
SHA1

adedc2fec00056559f911bdfb40bae883c6bbaa4
SHA256

8bedd5cf2d48da4f1533ffdd999dd62f48a49a97d16ee67ee837caa9dd2d7d33
SHA512

e3fa5d492fac29f2a6fa26a6d9d5dbefb35295fea329c282d019212d4a3048777f8c70c0d48e38bf8629d4b0f68e0f4a59501b1797665d760220fad496f06f3e
SSDEEP

1536:MzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDIBpmDtoMOqiXWpyW2C9PqPxUzZ:jqJogYkcSNm9V7DIBk9i2gPxsqYT

Score

10^/10

lockbit discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  2024-12-05_70c964b9aeac25bc97055030a1cfb58a_darkside
- Size
  
  145KB
- MD5
  
  70c964b9aeac25bc97055030a1cfb58a
- SHA1
  
  adedc2fec00056559f911bdfb40bae883c6bbaa4
- SHA256
  
  8bedd5cf2d48da4f1533ffdd999dd62f48a49a97d16ee67ee837caa9dd2d7d33
- SHA512
  
  e3fa5d492fac29f2a6fa26a6d9d5dbefb35295fea329c282d019212d4a3048777f8c70c0d48e38bf8629d4b0f68e0f4a59501b1797665d760220fad496f06f3e
- SSDEEP
  
  1536:MzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDIBpmDtoMOqiXWpyW2C9PqPxUzZ:jqJogYkcSNm9V7DIBk9i2gPxsqYT
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (345) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer