lockbit | 74b812ac49287fd6161fdad78223821f7005501fec4644eaa1dd89b6e40c2f34

General

Target

2024-12-27_d0729e9b53b9ae6898be31d4c82fcedd_darkside
Size

147KB
Sample

241227-p1hfxavqgk
MD5

d0729e9b53b9ae6898be31d4c82fcedd
SHA1

4cc9743bb3a016eb97d5e12807a52789b13584a2
SHA256

74b812ac49287fd6161fdad78223821f7005501fec4644eaa1dd89b6e40c2f34
SHA512

21e945d238f1e00b7becbccbc1666d1e67f842ef485a5980e7da1975d2c6ccbe99af28d4a9cce36c32511ecf388456d2ead1355ed8c5c123b04b10e369bcf555
SSDEEP

3072:y6glyuxE4GsUPnliByocWep0d0EVvOkEig5ErIiRq:y6gDBGpvEByocWe6ay8icEd

Score

10^/10

Malware Config

Extracted

Path

C:\gfDvEmfFb.README.txt

Ransom Note

YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: B5FEFD6406D1719DA608F1F488F83AAF Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Emails

[email protected]

Extracted

Path

C:\gfDvEmfFb.README.txt

Ransom Note

YOUR FILES ARE ENCRYPTED Your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Your personal DECRYPTION ID: B5FEFD6406D1719D7422DD76126BBCE8 Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] telegram: @somran2024 Attention! * Do not rename or edit encrypted files and archives containing encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. * We have been in your network for a long time. We know everything about your company most of your information has already been downloaded to our server. We recommend you to do not waste your time if you dont wont we start 2nd part. * You have 24 hours to contact us. * Otherwise, your data will be sold or made public.

Emails

[email protected]

Targets

- Target
  
  2024-12-27_d0729e9b53b9ae6898be31d4c82fcedd_darkside
- Size
  
  147KB
- MD5
  
  d0729e9b53b9ae6898be31d4c82fcedd
- SHA1
  
  4cc9743bb3a016eb97d5e12807a52789b13584a2
- SHA256
  
  74b812ac49287fd6161fdad78223821f7005501fec4644eaa1dd89b6e40c2f34
- SHA512
  
  21e945d238f1e00b7becbccbc1666d1e67f842ef485a5980e7da1975d2c6ccbe99af28d4a9cce36c32511ecf388456d2ead1355ed8c5c123b04b10e369bcf555
- SSDEEP
  
  3072:y6glyuxE4GsUPnliByocWep0d0EVvOkEig5ErIiRq:y6gDBGpvEByocWe6ay8icEd
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (341) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2