lockbit | f016df16d0f34aaae36bf10e0ca6bccdce2a4d552fcc6444e6f48318ef0b2c4a

General

Target
_f016df16d0f34aaae36bf10e0ca6bccdce2a4d552fcc6444e6f48318ef0b2c4a.exe
Size 146KB
Sample260529-ps571abx71
SHA256 f016df16d0f34aaae36bf10e0ca6bccdce2a4d552fcc6444e6f48318ef0b2c4a
MD5 4e6ba23ef44cf029840880a48dbc4768
SHA1 bafc3865d3cfe1c48709ed21dcc371896b67349f
SHA512 8e8fb528b19d98eb640cef382ba34aa6ce177d32d1036cf6241336c890387bdffe3dbfc8760f647018acd3c8e4978f4cb0fbfbd3710c5c4afb16da103bbc6be5
SSDEEP 3072:n6glyuxE4GsUPnliByocWepKrIc20QvsG:n6gDBGpvEByocWeEXQv5
TLSH
T10AE37D21F212D0B3C83718F53736B5B2B39E8D2C15A96817EAD80F5DBCA58232F45997
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _f016df16d0f34aaae36bf10e0ca6bccdce2a4d552fcc6444e6f48318ef0b2c4a.exe
- Size 146KB
- SHA256 f016df16d0f34aaae36bf10e0ca6bccdce2a4d552fcc6444e6f48318ef0b2c4a
- MD5 4e6ba23ef44cf029840880a48dbc4768
- SHA1 bafc3865d3cfe1c48709ed21dcc371896b67349f
- SHA512 8e8fb528b19d98eb640cef382ba34aa6ce177d32d1036cf6241336c890387bdffe3dbfc8760f647018acd3c8e4978f4cb0fbfbd3710c5c4afb16da103bbc6be5
- SSDEEP 3072:n6glyuxE4GsUPnliByocWepKrIc20QvsG:n6gDBGpvEByocWeEXQv5
- TLSH
  T10AE37D21F212D0B3C83718F53736B5B2B39E8D2C15A96817EAD80F5DBCA58232F45997
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (983) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2