lockbit | e90bd4ffc09f362b480fd8b751fc055476bb250e33236230d5058bc73c04ee36

General

Target
rr.exe
Size 149KB
Sample251223-p8s8dazld1
SHA256 e90bd4ffc09f362b480fd8b751fc055476bb250e33236230d5058bc73c04ee36
MD5 2d6fc7281e8fa096f87e7c5b60ed9034
SHA1 ffaa98f9fa4c159636943ddb6c6c6978ee03b2da
SHA512 6c34408db42e94fe07e77dba1b66695496f8beadf3b173330c6a2c35b9669441abf0eca997d24acfa9df07ffffb1d8abe883679a63eff95782788c4b658b38c7
SSDEEP 1536:kzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDT8Oxa6sHOIsRF/7h9Hbi19YdVT:rqJogYkcSNm9V7DTn8sDzO19wVT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\94ALMxE8E.README.txt

Ransom Note

~~~ Rans0m Resp0nse R|R The World's Greatest Ransomware ~~~ >>>> If you are reading this then we are sorry to tell you that you are the Victims of the best Ransomeware Virus on the planet. Every single piece of data on your systems has not been encrypted with military grade encryption, and we have also made copies of every file and uploaded it to our servers. Thankfully for you we have the one and only way to restore all of your files back to normal like this never happened, and that way is with our decryptor and decryption key. In order for us to allow you to have everything back, including all of your files and a promise we will never leak or sell the data we have stolen, you must pay 4000 USD worth of the Cryptocurrency Bitcoin to the following Bitcoin Wallet Address. Bitcoin Wallet Address where you will send the 4000 USD in bitcoin is bc1qa4l94p7mvd6qcpmgwp3njfwkj72f5lh5n946fu You have 72 hours from reading this message to pay the 4000 USD in bitcoin to the wallet address above or we will assume you are not cooperating and will sell ALL of your data to other CyberCrime Groups, Business Competitors, Sanctioned Nation State Government Agencies and EVERYONE else who would love to pay money for it. Also, failing to pay not only gets your data leaked and sold, but we will continue to impose cyber attacks on every system you have. We can promise you it is in your best interest to pay the small amount, and have all your files restored within 10 minutes of paying us. Once 4000 USD in bitcoin is deposited into this wallet address our software instantly notifies support, we will then connect remotely to your systems and provide the decryption software and your 1 of a kind custom user key that must be entered into the decryption program in which all files will be restored within 30 minutes. ONE FINAL TIME SO YOU GET THIS PART CORRECT, WE ARE NOT RESPONSIBLE FOR PAYMENTS SEND TO WRONG BITCOIN WALLET ADDRESS, Four Thousand USD in the cryptocurrency BITCOIN to bc1qa4l94p7mvd6qcpmgwp3njfwkj72f5lh5n946fu >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Targets

- Target
  rr.exe
- Size 149KB
- SHA256 e90bd4ffc09f362b480fd8b751fc055476bb250e33236230d5058bc73c04ee36
- MD5 2d6fc7281e8fa096f87e7c5b60ed9034
- SHA1 ffaa98f9fa4c159636943ddb6c6c6978ee03b2da
- SHA512 6c34408db42e94fe07e77dba1b66695496f8beadf3b173330c6a2c35b9669441abf0eca997d24acfa9df07ffffb1d8abe883679a63eff95782788c4b658b38c7
- SSDEEP 1536:kzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDT8Oxa6sHOIsRF/7h9Hbi19YdVT:rqJogYkcSNm9V7DTn8sDzO19wVT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

credential_access defense_evasion discovery ransomware spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2