Extracted

• • Target
    RarBit.rar
  • Size 159KB
  • SHA256 7415f740e23c9c7fd388b1ca46b73e682566f1ce1949514934cb390649508bfb
  • MD5 45b05e653ce15ab0c143a600bbe77c77
  • SHA1 2a9e88bce11682878426f9c41066966381945797
  • SHA512 5d9dcb3199238aa018e447768c222adb56a116bbe1232b611758930cef2c766f10d951216df95ff964ea86824f71881b71462b2eee2e3383c2638b1b9e5587b2
  • SSDEEP 3072:vvDniU3dQNgItwzs11CNq2Yi6n9hWuEUTzZEq4DyEu+OSqZs+XYu9ZXwJBbZ:TnJ32ge/HCR290pEzMDy7e6su9Z6BbZ
  • TLSH
    T175F312B7E2E168D211750A3443EF46E7ACD7D23946EA693386BC46869C400D3A3BBC75
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionblackmatterlockbitransomwarespywarestealer

  • Family: BlackMatter Ransomware

    BlackMatter ransomware group claims to be Darkside and REvil succesor.

    ransomwareblackmatter

  • Family: Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit

  • Rule to detect Lockbit 3.0 ransomware Windows payload

  • Renames multiple (851) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1