lockbit | a9ec4fc4ddbd5d0d7f5d2d6645349e80b87d58e2d0c6bdf27d7257fad0e8ea7d

General

Target
prankransom.7z
Size 410KB
Sample260807-ndsspacn6v
SHA256 a9ec4fc4ddbd5d0d7f5d2d6645349e80b87d58e2d0c6bdf27d7257fad0e8ea7d
MD5 fd0a82c6673109faa987c3411022746b
SHA1 c74bf6925d5228b43f8bfaa2ebdaa629f2c81ea2
SHA512 52701d1bf20f6bf7354bdcf87ea1e9a5827de5098f54175cb70969fbd666051d84ae89977649d69681e1a4becaa746eda099fec99624ee47b39836ddc7f65310
SSDEEP 6144:lNfswqXCx3AbTHVoGPk1ZJ5xSlQhc9EdkNLywgT9OtL7WRrIqwrEQX9XTnY:QHtTHVm1ZJ54lQhEqqTtWRMqXMjY
TLSH
T1FA9423B747F077E1C8CC8D20C495B67FB193B1ECE6EA84AFA925A202C755F49861DC02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

lockbit

Ransom Note

~~~ LockBit 3.0 the world's fastest ransomware since 2019~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us with your personal DECRYPTION ID: 951AB9B709B10993C200D8DF31B0F7F7 >>>> To contact us: 1. Download Getsesion https://getsession.org/download 2. Add friend my id: 0576f87ce7ad049d7f1e24cab3780853b589bcfa9601302eb005c041f3a504fe7a >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

URLs

https://getsession.org/download

Targets

- Target
  prankransom/HLJkNskOq.README.txt
- Size 1KB
- SHA256 c61c31648555f2ab2facf421a961ec6d90835f218d8c78c890150569ddd5f6f5
- MD5 590b564a781f6856072e72a6c6e966c4
- SHA1 c53176ba395e0272b85de480ac38048ca8139f35
- SHA512 46e281d9d4be41bbd72585458af5265bc2274cf26b131c9a0b0b908dc590672197a8fc8901824bac1aabe498f3c271690ec2712054c6f28ef261fb0e341ad46e
- TLSH
  T1A3213F2EB74A853D59D211E13B3F4CDBD322A048B75953152CA0904C3372E560A2B1DA
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral1
- Target
  prankransom/bg.png
- Size 421KB
- SHA256 50efc2aafeabfce08d2d0d5c42f5414026548c31caa8de8425659e0b6161a2b3
- MD5 34b338e6699102650465668daa3f1b43
- SHA1 0e07094ada242a8de33546e1fa71fea2054247a9
- SHA512 752ba56a101a764dce55df7b3db7249a8fc332ca725ab235382f21e51c5c5ee0553fd6a8b272a35b17a306ae03460f574283e76c72ed5c81fc91cc5250ffba8b
- SSDEEP 12288:3WphWFvrdHVm1ZlFYBqQXg+5SqXszMjDHvetw:3mgFzFMPFRQXx0M1
- TLSH
  T14F9423FB9E805DEDCA384C34A86093253A72B73564A70DAB3DBE464453C1F1C9961CBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  prankransom/icon.ico
- Size 2KB
- SHA256 c81d4572bbcaeb00db8d061aad2096d57708c147c5d9ee5615dd6d1a654f85c8
- MD5 273403e8bfc13455c6091eafc08540da
- SHA1 953337f19fb1e7e480d1a6bfac9de4cb619e229e
- SHA512 138f3de04da1cc17ba6b1ae6365dcf9824e02e104044b78338af5b652efaa604c71af2f60547aa946a3f6a37ed52ca5d05db2f03000a1fe52ef85ef0ac68d362
- TLSH
  T1A6515926FC27EF46CCBC54F4189596712B946F09E2A386662A8C3D76E4E58C336D2081
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3
- Target
  prankransom/lockbit.vbs
- Size 1KB
- SHA256 21d0d996c1b58448410a74caa2d8bb563664ba07d6f4f53d8f8b8a0e16558bce
- MD5 788f2a477aada33f770d341d1479064a
- SHA1 d861275b5aed1b318440a927771af40d29d277ad
- SHA512 a00ce9f487bd92424c041612fa6344780856b4aee882decd7bcf75b26ac9d3e5d366b902df4889217b5c73d049923bccee1edf7297f49d964fd37a80728f616a
- TLSH
  T149415402B7274337C562560A69A36C9DC3620697751148D679ECC8108FFDC1467B5BEE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware defense_evasion execution persistence privilege_escalation ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral4