lockbit | 511d32b8ffcaca77f86601ae758adec70949b46441f383cd6ab3dc02cc898723 | Triage

Sharing

General

Target

2025-01-17_30d2debba19325e4c07c147a538ef3fc_darkside
Size

145KB
Sample

250117-le929a1phj
MD5

30d2debba19325e4c07c147a538ef3fc
SHA1

7d5a7965fe464b391daf0d36dfb862d7f53c7728
SHA256

511d32b8ffcaca77f86601ae758adec70949b46441f383cd6ab3dc02cc898723
SHA512

2c8b02593ea454da7e33eb453eada12525a33c501b217c11aa6dd88bf254df5c057a9b2f7deff2df74b27cd361c2e1c9b0abeae965552500c6a69791a5a8c7d1
SSDEEP

3072:uqJogYkcSNm9V7DjE3JJIa+cg3jdaNUKT:uq2kc4m9tD4ZUJOU

Score

10^/10

lockbit discovery ransomware spyware stealer

Malware Config

Targets

- Target
  
  2025-01-17_30d2debba19325e4c07c147a538ef3fc_darkside
- Size
  
  145KB
- MD5
  
  30d2debba19325e4c07c147a538ef3fc
- SHA1
  
  7d5a7965fe464b391daf0d36dfb862d7f53c7728
- SHA256
  
  511d32b8ffcaca77f86601ae758adec70949b46441f383cd6ab3dc02cc898723
- SHA512
  
  2c8b02593ea454da7e33eb453eada12525a33c501b217c11aa6dd88bf254df5c057a9b2f7deff2df74b27cd361c2e1c9b0abeae965552500c6a69791a5a8c7d1
- SSDEEP
  
  3072:uqJogYkcSNm9V7DjE3JJIa+cg3jdaNUKT:uq2kc4m9tD4ZUJOU
Score

9^/10

discovery ransomware spyware stealer
- Renames multiple (353) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomwarespywarestealer

behavioral2

discoveryransomwarespywarestealer