lockbit | 6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757

General

Target

1.exe
Size

147KB
Sample

250109-ldly2awkhs
MD5

c09185c157831e4915c255d7002941f4
SHA1

beca597f2c2c120c3d74163501a81f56664ff4f7
SHA256

6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757
SHA512

a843854ca79f4d98938635612d20f3d5b79d8661ee91d1ae130b2deffe95e44d7028f76b8b221c87fab0638afe5baf3c55e8348f8aa10dddc90133167a3c17bf
SSDEEP

3072:SqJogYkcSNm9V7DnfX/91c6G+Mqc+2EIEMF+T:Sq2kc4m9tDnfXPc6g+2XEMF

Score

10^/10

Malware Config

Extracted

Path

C:\5VFg9o5tW.README.txt

Ransom Note

------Dear managers!------ If you are reading this, it means your network has been attacked. What does that mean? We hacked your network and now all your files, documents, client database, projects and other important data safely encrypted with reliable algorithms. we also have a copy of all your data. WARNING!!! You don't have to go to the POLICE, etc. Otherwise we will not be able to help you. You cannot acces the files right now. But do not worry. You can get it back! It is easy to recover in a few steps. As proof, we can decrypt any 3 files you provide. We are not interested to ruin your business. We want to get ransom and be happy. Please bring this information to your team leaders as soon as possible. In case of a successfull transaction, we will restore your systems within 4-6 hours and also provide security recommendations. -----------------------WARNING----------------------- If you modify files - our decrypt software won't able to recover data If you use third party software - you can damage/modify files (see item 1) You nedd cipher key / our decrypt software to restore you files. The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -----------------------RECOVERY----------------------- Use email: [email protected] Alternative email address: [email protected] ([email protected]) ID message: c5337115f1d1a

Emails

[email protected]

Targets

- Target
  
  1.exe
- Size
  
  147KB
- MD5
  
  c09185c157831e4915c255d7002941f4
- SHA1
  
  beca597f2c2c120c3d74163501a81f56664ff4f7
- SHA256
  
  6f3d87f3dcfd248e64d26cf338a19f41a6f93affdde5fab071a631ff38637757
- SHA512
  
  a843854ca79f4d98938635612d20f3d5b79d8661ee91d1ae130b2deffe95e44d7028f76b8b221c87fab0638afe5baf3c55e8348f8aa10dddc90133167a3c17bf
- SSDEEP
  
  3072:SqJogYkcSNm9V7DnfX/91c6G+Mqc+2EIEMF+T:Sq2kc4m9tDnfXPc6g+2XEMF
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (350) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2