lockbit | d62754b5a0886643f185cdb0099c6bf5e9c17c13654d7b191ae8fcee21a7f111 | Triage

Sharing

General

Target

2025-01-01_e69d2b8d2b57e14ba567555313f06e84_darkside
Size

145KB
Sample

250101-mvqh8avpdr
MD5

e69d2b8d2b57e14ba567555313f06e84
SHA1

d26fbeda7aa0ce38eba80877c8c8670aafe3eebb
SHA256

d62754b5a0886643f185cdb0099c6bf5e9c17c13654d7b191ae8fcee21a7f111
SHA512

a1e663413d417d2763f6f00800c802c9d813cfdb0be6f051ceab73a5a32a7299fb51cfcd3b9a8a0bf23ecc1ff2f9c6802c39a83dd32b8ac7825397a60372eed9
SSDEEP

1536:lzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD3+CXCeoYnTSo1wm6srHUyz:mqJogYkcSNm9V7D3DlXnTScZTT

Score

10^/10

lockbit discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  2025-01-01_e69d2b8d2b57e14ba567555313f06e84_darkside
- Size
  
  145KB
- MD5
  
  e69d2b8d2b57e14ba567555313f06e84
- SHA1
  
  d26fbeda7aa0ce38eba80877c8c8670aafe3eebb
- SHA256
  
  d62754b5a0886643f185cdb0099c6bf5e9c17c13654d7b191ae8fcee21a7f111
- SHA512
  
  a1e663413d417d2763f6f00800c802c9d813cfdb0be6f051ceab73a5a32a7299fb51cfcd3b9a8a0bf23ecc1ff2f9c6802c39a83dd32b8ac7825397a60372eed9
- SSDEEP
  
  1536:lzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD3+CXCeoYnTSo1wm6srHUyz:mqJogYkcSNm9V7D3DlXnTScZTT
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (363) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer