lockbit | 763b65a4c7cf55aba8913378892cb0716585f502bc2695e839b493a46c372b5e | Triage

Sharing

General

Target

2024-12-18_256ad00d2ead9b2d3734301108cfd4d7_darkside
Size

147KB
Sample

241218-hfs9caypdp
MD5

256ad00d2ead9b2d3734301108cfd4d7
SHA1

dd9c909dc8b269b780e4c416f1acdcdb34763eeb
SHA256

763b65a4c7cf55aba8913378892cb0716585f502bc2695e839b493a46c372b5e
SHA512

974879b9742911743da4f7b3cc1c00e189306939518c32eaa53b5441006eea6b708f55040df7da0a39655beaa0c75aa2c28dad6d1dfac3fbeb6aaf44d48678a9
SSDEEP

3072:HqJogYkcSNm9V7DQRjq2vsdXbzTuP5SRRBdf1CT:Hq2kc4m9tD3NPwUFf1

Score

10^/10

lockbit discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  2024-12-18_256ad00d2ead9b2d3734301108cfd4d7_darkside
- Size
  
  147KB
- MD5
  
  256ad00d2ead9b2d3734301108cfd4d7
- SHA1
  
  dd9c909dc8b269b780e4c416f1acdcdb34763eeb
- SHA256
  
  763b65a4c7cf55aba8913378892cb0716585f502bc2695e839b493a46c372b5e
- SHA512
  
  974879b9742911743da4f7b3cc1c00e189306939518c32eaa53b5441006eea6b708f55040df7da0a39655beaa0c75aa2c28dad6d1dfac3fbeb6aaf44d48678a9
- SSDEEP
  
  3072:HqJogYkcSNm9V7DQRjq2vsdXbzTuP5SRRBdf1CT:Hq2kc4m9tD3NPwUFf1
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (330) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer