lockbit

General

Target

README.txt.lnk
Size

1KB
Sample

250126-r789bavrgr
MD5

e1cff745a65a199bdf9dfebe3f69e3f7
SHA1

8c77e01ceb0ff774a66afa5b7a32b0735e422e9e
SHA256

3b497ec4d80770a5172a72f871528397fde8ea5969aa2c3cde98edb0a6946355
SHA512

7e9204f24290dfdff14200945a31b7d3421122f3fb526845a8250e4325751af5fac226057becf1d0d381f021cca6aae7f6fe0b2d2b517c3441006423de03496c

Score

10^/10

Malware Config

Extracted

Path

C:\RlWCfyLxZ.README.txt

Ransom Note

======================================== !!! ATTENTION !!! Your Files Have Been Encrypted by ManiaCrypt ======================================== What Happened? -------------- All of your important files, documents, photos, and databases have been encrypted using RSA. Without our decryption program, your files cannot be restored. Why Trust Us: -------------------- If we dont give you the decryption program after payment, nobody will trust us. What You Need to Do: -------------------- To get the decryption program, you must contact us. Steps to Restore Your Files: ---------------------------- 1. Open Discord and add the username ballets4. 2. Send us a message and mention your situation. 3. We will provide further instructions for obtaining the decryption program. Important Information: ----------------------- - DO NOT attempt to recover your files using third-party tools. They may damage your data and make recovery impossible. - DO NOT rename, move, or modify the encrypted files. This will also make decryption impossible. - Only we have the tools required to decrypt your files safely and effectively. We are waiting for your message. Time is critical. ======================================== Your Files. Your Responsibility. ========================================

Targets

- Target
  
  README.txt.lnk
- Size
  
  1KB
- MD5
  
  e1cff745a65a199bdf9dfebe3f69e3f7
- SHA1
  
  8c77e01ceb0ff774a66afa5b7a32b0735e422e9e
- SHA256
  
  3b497ec4d80770a5172a72f871528397fde8ea5969aa2c3cde98edb0a6946355
- SHA512
  
  7e9204f24290dfdff14200945a31b7d3421122f3fb526845a8250e4325751af5fac226057becf1d0d381f021cca6aae7f6fe0b2d2b517c3441006423de03496c
Score

10^/10

lockbit defense_evasion discovery ransomware spyware stealer
- Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Lockbit family
  lockbit
- Rule to detect Lockbit 3.0 ransomware Windows payload
- Renames multiple (622) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2