Overview
overview
10Static
static
10LockBit-Bl...in.zip
windows7-x64
LockBit-Bl...in.zip
windows10-2004-x64
LockBit-Bl...in.zip
android-10-x64
LockBit-Bl...in.zip
android-13-x64
LockBit-Bl...in.zip
macos-10.15-amd64
LockBit-Bl...in.zip
ubuntu-18.04-amd64
LockBit-Bl...in.zip
debian-9-armhf
LockBit-Bl...in.zip
debian-9-mips
LockBit-Bl...in.zip
debian-9-mipsel
LockBit-Bl...ID.txt
windows7-x64
LockBit-Bl...ID.txt
windows10-2004-x64
LockBit-Bl...ID.txt
android-11-x64
LockBit-Bl...ID.txt
android-13-x64
LockBit-Bl...ID.txt
macos-10.15-amd64
LockBit-Bl...ID.txt
ubuntu-18.04-amd64
LockBit-Bl...ID.txt
debian-9-armhf
LockBit-Bl...ID.txt
debian-9-mips
LockBit-Bl...ID.txt
debian-9-mipsel
LockBit-Bl...B3.exe
windows7-x64
10LockBit-Bl...B3.exe
windows10-2004-x64
10LockBit-Bl...B3.exe
android-10-x64
LockBit-Bl...B3.exe
android-13-x64
LockBit-Bl...B3.exe
macos-10.15-amd64
LockBit-Bl...B3.exe
ubuntu-18.04-amd64
LockBit-Bl...B3.exe
debian-9-armhf
LockBit-Bl...B3.exe
debian-9-mips
LockBit-Bl...B3.exe
debian-9-mipsel
LockBit-Bl...ll.txt
windows7-x64
LockBit-Bl...ll.txt
windows10-2004-x64
LockBit-Bl...ll.txt
android-10-x64
LockBit-Bl...ll.txt
android-13-x64
LockBit-Bl...ll.txt
macos-10.15-amd64
General
-
Target
LockBit-Black-Builder-main.zip
-
Size
1.7MB
-
Sample
250205-nkmv1swker
-
MD5
4fb693236754d28c43d3123b555ae740
-
SHA1
d3d6f0aa6068e9b2b9b47875bc13500392494421
-
SHA256
f566f21f3db0c4a9f421f18e6561279b4dd4c5fd3c32456a6f2e5b927b49719d
-
SHA512
ba81e0077f8dfbcbe58eda07d5b403089a71d56ae33578ba07abb7101c6254c9a7e042af2c0ede74b12fa142731c0ce638e7a98fd620e910bad7fbbdba710383
-
SSDEEP
49152:Qm7iJLGvI8SbLm7S8lMA7DAJRxZ73a9VlknZbQT9:6JqgjiL+WEJRx6QZbQh
Behavioral task
behavioral1
Sample
LockBit-Black-Builder-main.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
LockBit-Black-Builder-main.zip
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
LockBit-Black-Builder-main.zip
Resource
android-x64-20240624-en
Behavioral task
behavioral4
Sample
LockBit-Black-Builder-main.zip
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral5
Sample
LockBit-Black-Builder-main.zip
Resource
macos-20241106-en
Behavioral task
behavioral6
Sample
LockBit-Black-Builder-main.zip
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral7
Sample
LockBit-Black-Builder-main.zip
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral8
Sample
LockBit-Black-Builder-main.zip
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral9
Sample
LockBit-Black-Builder-main.zip
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral10
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
android-x64-arm64-20240624-en
Behavioral task
behavioral13
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral14
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
macos-20241101-en
Behavioral task
behavioral15
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral16
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral17
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral18
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral19
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral21
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
android-x64-20240624-en
Behavioral task
behavioral22
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
android-33-x64-arm64-20240910-en
Behavioral task
behavioral23
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
macos-20241101-en
Behavioral task
behavioral24
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral25
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral26
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral27
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral28
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/Password_dll.txt
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/Password_dll.txt
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/Password_dll.txt
Resource
android-x64-20240910-en
Behavioral task
behavioral31
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/Password_dll.txt
Resource
android-33-x64-arm64-20240624-en
Behavioral task
behavioral32
Sample
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/Password_dll.txt
Resource
macos-20241106-en
Malware Config
Extracted
blackmatter
25.239
Extracted
blackmatter
65.239
Extracted
C:\ZImkTWSLZ.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Extracted
C:\ZImkTWSLZ.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Targets
-
-
Target
LockBit-Black-Builder-main.zip
-
Size
1.7MB
-
MD5
4fb693236754d28c43d3123b555ae740
-
SHA1
d3d6f0aa6068e9b2b9b47875bc13500392494421
-
SHA256
f566f21f3db0c4a9f421f18e6561279b4dd4c5fd3c32456a6f2e5b927b49719d
-
SHA512
ba81e0077f8dfbcbe58eda07d5b403089a71d56ae33578ba07abb7101c6254c9a7e042af2c0ede74b12fa142731c0ce638e7a98fd620e910bad7fbbdba710383
-
SSDEEP
49152:Qm7iJLGvI8SbLm7S8lMA7DAJRxZ73a9VlknZbQT9:6JqgjiL+WEJRx6QZbQh
Score3/10 -
-
-
Target
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/DECRYPTION_ID.txt
-
Size
16B
-
MD5
b1cd07d8c346e344042066aee57ea45b
-
SHA1
1dd2a84bcf04a59c7d643c0852661e09a983630a
-
SHA256
47a9e1ce014c3ddeb3c19bbdfbe3671a5944f71313710ba2796e2ac058544322
-
SHA512
10fdb9478115a137535db230779adb7a1c80a9f78aa8934b1e23a71210a24e986a800371d0b9e1f693d095dc8b646ea77a67d144e172b362d8b27d406c3d0e37
Score1/10 -
-
-
Target
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/LB3.exe
-
Size
153KB
-
MD5
c73eac0c837c3c5caca3a885f46c17d9
-
SHA1
a0ca9511b40c9c2451986ce179016ec4014e9adb
-
SHA256
e609bf8406b61613f3e605d277cf445059974a4c71c3edd09fffae86a3c5dbfe
-
SHA512
157c92e561cd18876ab60faf8a3d8e62633e7750accb965e86f3202b0d5ff902d3ae51fb41592d9be22672e67a713291e469a09be57e6f77dd6343090324792a
-
SSDEEP
3072:xqJogYkcSNm9V7D2YRLCm8ZdqVAxrMismEm8T:xq2kc4m9tDlhLqb
-
Lockbit family
-
Renames multiple (318) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
LockBit-Black-Builder-main/LockBit-Black-Builder-main/LockBit30/Build/Password_dll.txt
-
Size
1KB
-
MD5
cd73e5da7534c1cc75358e77bced80ba
-
SHA1
684301a030de00bf594f32dbc58e6caed663ecd5
-
SHA256
dd27eb7a55e7ef44d9d2e0cb92108637c8248d58532c22d59e8057e7da111580
-
SHA512
fb747890e36a0e9144bb23917118d6b14cd5ea20434d3f241ceb1de8a21c92539d9cac07bac8d17ae69bae754f941f9326203c06e95d86d7cf20a542af0f060e
Score1/10 -
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1