General
-
Target
21479006187.zip
-
Size
159KB
-
Sample
250219-m16sdszkhl
-
MD5
15b6da7b98f17da1ed90c2f9d9855403
-
SHA1
1d69840bdefaa01aa994ad02163cd6a82c22d26c
-
SHA256
af7d569e6174bbdc8744c51008b35973b7ba17cebd672e841890e41c80a8aaf3
-
SHA512
77cf7f0b45906aab88ba8ddb3d911612cb6bfca85dd8014a156f7d2b004218b6dc84c95155126022b2698737ec1ce205fc3b2ca54b4e0b628d6052de937e1af4
-
SSDEEP
3072:0XKnju01eioEigZKcgbyZ3gOxc+ZuifC1eWW+6eb/ZqWY+0F4AbK6Sv8xwxm8:0XKnjHic5gedgMR3eL90F4A+6u5P
Static task
static1
Behavioral task
behavioral1
Sample
1d3bce3d514218da43e891c996690a9bbe10a73573aae0bb1f1202e7cd1f1fd3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1d3bce3d514218da43e891c996690a9bbe10a73573aae0bb1f1202e7cd1f1fd3.exe
Resource
win10v2004-20250217-en
Malware Config
Extracted
C:\I6hf6mgSc.README.txt
lockbit
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion
http://lockbitapt.uz
http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly
http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly
http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly
http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly
http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly
http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly
http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly
http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly
http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly
https://twitter.com/hashtag/lockbit?f=live
http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion
http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion
http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion
http://lockbitsupp.uz
https://tox.chat/download.html
Targets
-
-
Target
1d3bce3d514218da43e891c996690a9bbe10a73573aae0bb1f1202e7cd1f1fd3
-
Size
167KB
-
MD5
0fb120b596d50631ba1744c0de978ee7
-
SHA1
6b4bfae963bfcbf4c62884273b5df0d609884c67
-
SHA256
1d3bce3d514218da43e891c996690a9bbe10a73573aae0bb1f1202e7cd1f1fd3
-
SHA512
206169abdf388573b1462126cf0733e02c187c1856e2519ffba6acba8552efb51f3bceef87fe67ef4fc85ede8d2ef02e486f16deea29c3eb0f656f7cde25005d
-
SSDEEP
3072:Lz6RE5MJtrfB1K/1uBrhPMm3M0Vfl70Ol99W4hBEiK2qCoXusZOcDHjmIqAmF/2b:H6RYcauBrhP9M0T79vFqCCJDoA8qAACK
-
Lockbit family
-
Renames multiple (362) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-