lockbit | 984d394fb9324130b52cc05e04db17fd6e1743652e3500e8fbc0b28cc06f125c

General

Target

91qsdf.exe
Size

147KB
Sample

250119-tle5fsvnbt
MD5

3c2c0b97e9295c60267c533010ad9253
SHA1

270ddd75d7880a91c0a0cafaffed4f2757f54770
SHA256

984d394fb9324130b52cc05e04db17fd6e1743652e3500e8fbc0b28cc06f125c
SHA512

c6fed2954e05a33d5ef99610b937450043fc61fa0537f9da982e2c0dcac1ee26f734609ed207b12ad8dda31d191af2072c76b9f19ffbaa4a56b09b47a5955914
SSDEEP

3072:GqJogYkcSNm9V7DQ4loXzHg0cSlm7FzT:Gq2kc4m9tDQ4aX00cWm7F

Score

10^/10

Malware Config

Extracted

Path

C:\xP8S4N9J1.README.txt

Ransom Note

======================================== !!! ATTENTION !!! Your Files Have Been Encrypted by ManiaCrypt ======================================== What Happened? -------------- All of your important files, documents, photos, and databases have been encrypted using RSA. Without our decryption program, your files cannot be restored. Why Trust Us: -------------------- If we dont give you the decryption program after payment, nobody will trust us. What You Need to Do: -------------------- To get the decryption program, you must contact us. Steps to Restore Your Files: ---------------------------- 1. Open Discord and add the username ballets4. 2. Send us a message and mention your situation. 3. We will provide further instructions for obtaining the decryption program. Important Information: ----------------------- - DO NOT attempt to recover your files using third-party tools. They may damage your data and make recovery impossible. - DO NOT rename, move, or modify the encrypted files. This will also make decryption impossible. - Only we have the tools required to decrypt your files safely and effectively. We are waiting for your message. Time is critical. ======================================== Your Files. Your Responsibility. ========================================

Targets

- Target
  
  91qsdf.exe
- Size
  
  147KB
- MD5
  
  3c2c0b97e9295c60267c533010ad9253
- SHA1
  
  270ddd75d7880a91c0a0cafaffed4f2757f54770
- SHA256
  
  984d394fb9324130b52cc05e04db17fd6e1743652e3500e8fbc0b28cc06f125c
- SHA512
  
  c6fed2954e05a33d5ef99610b937450043fc61fa0537f9da982e2c0dcac1ee26f734609ed207b12ad8dda31d191af2072c76b9f19ffbaa4a56b09b47a5955914
- SSDEEP
  
  3072:GqJogYkcSNm9V7DQ4loXzHg0cSlm7FzT:Gq2kc4m9tDQ4aX00cWm7F
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (361) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2