lockbit | 2e3876a4a2e1d7456dbc95a254b419de25a9b26d2bab3d98d8c9ff0faa43b48c

General

Target
_2e3876a4a2e1d7456dbc95a254b419de25a9b26d2bab3d98d8c9ff0faa43b48c.exe
Size 146KB
Sample260529-phnvzabw2w
SHA256 2e3876a4a2e1d7456dbc95a254b419de25a9b26d2bab3d98d8c9ff0faa43b48c
MD5 90f10623c08e19324e6fce66ae11df18
SHA1 af81578b624eca0379af79221841ae2de7485905
SHA512 060c31062995f8f0edee0b1e893981642ce40c70b0ae77d7e95d4fb15c01eabd43f901d0777e9f8c22d5c5c2ebf110c948c636a060c3895f20aa69af4259de3e
SSDEEP 3072:M6glyuxE4GsUPnliByocWephIid7rXg0Tb5oZw3:M6gDBGpvEByocWeThJrwsqw
TLSH
T187E37D21F213D0B3C83718F13736B572B39E8E6C19996947EAD80F59BCA58232F15993
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _2e3876a4a2e1d7456dbc95a254b419de25a9b26d2bab3d98d8c9ff0faa43b48c.exe
- Size 146KB
- SHA256 2e3876a4a2e1d7456dbc95a254b419de25a9b26d2bab3d98d8c9ff0faa43b48c
- MD5 90f10623c08e19324e6fce66ae11df18
- SHA1 af81578b624eca0379af79221841ae2de7485905
- SHA512 060c31062995f8f0edee0b1e893981642ce40c70b0ae77d7e95d4fb15c01eabd43f901d0777e9f8c22d5c5c2ebf110c948c636a060c3895f20aa69af4259de3e
- SSDEEP 3072:M6glyuxE4GsUPnliByocWephIid7rXg0Tb5oZw3:M6gDBGpvEByocWeThJrwsqw
- TLSH
  T187E37D21F213D0B3C83718F13736B572B39E8E6C19996947EAD80F59BCA58232F15993
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (851) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2