lockbit | dee450c1654e768ba58402bebd7834c2f36a321284d736917d76934578992bca

General

Target

LB3.exe
Size

147KB
Sample

250117-tg87qsvmhy
MD5

7d22648cc82617f20b631d91ad4112d0
SHA1

491f2cda7ba7500ad67d686faa6d866f1b49c708
SHA256

dee450c1654e768ba58402bebd7834c2f36a321284d736917d76934578992bca
SHA512

a5e48ca717a49977078f35a98b560460ccafefef87f17925e3807d0971dfd896441f08c1646708fc517ad89787a799527b77c076d219d4014384e5486c708f5d
SSDEEP

3072:9qJogYkcSNm9V7DoZVNgBlA+GiQ4pfOT:9q2kc4m9tD9A+wc

Score

10^/10

Malware Config

Extracted

Path

C:\hA89nI93a.README.txt

Ransom Note

======================================== !!! ATTENTION !!! Your Files Have Been Encrypted ======================================== What Happened? -------------- All of your important files, documents, photos, and databases have been encrypted using RSA. Without our decryption program, your files cannot be restored. Why Trust Us: -------------------- If we dont give you the decryption program after payment, nobody will trust us. What You Need to Do: -------------------- To get the decryption program, you must contact us. Steps to Restore Your Files: ---------------------------- 1. Open Discord and add the username ballets4. 2. Send us a message and mention your situation. 3. We will provide further instructions for obtaining the decryption program. Important Information: ----------------------- - DO NOT attempt to recover your files using third-party tools. They may damage your data and make recovery impossible. - DO NOT rename, move, or modify the encrypted files. This will also make decryption impossible. - Only we have the tools required to decrypt your files safely and effectively. We are waiting for your message. Time is critical. ======================================== Your Files. Your Responsibility. ========================================

Targets

- Target
  
  LB3.exe
- Size
  
  147KB
- MD5
  
  7d22648cc82617f20b631d91ad4112d0
- SHA1
  
  491f2cda7ba7500ad67d686faa6d866f1b49c708
- SHA256
  
  dee450c1654e768ba58402bebd7834c2f36a321284d736917d76934578992bca
- SHA512
  
  a5e48ca717a49977078f35a98b560460ccafefef87f17925e3807d0971dfd896441f08c1646708fc517ad89787a799527b77c076d219d4014384e5486c708f5d
- SSDEEP
  
  3072:9qJogYkcSNm9V7DoZVNgBlA+GiQ4pfOT:9q2kc4m9tD9A+wc
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (351) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2