lockbit | f7f6c966bbb6f3e9764512303a942a101e01762746fd60e384c2d6d6675ae962

General

Target
2026-09-16_89c7bffb602c9ffc364e51fab2a987ea_coinminer_darkside_elex_lockbit
Size 146KB
Sample260916-d4mn9azs2p
SHA256 f7f6c966bbb6f3e9764512303a942a101e01762746fd60e384c2d6d6675ae962
MD5 89c7bffb602c9ffc364e51fab2a987ea
SHA1 4192041845c3c798f7d9637ddb0e314b06b42a90
SHA512 f174877839fd45b24bbbdf826f154b15b5aea46f3757baf2bc958a6f92099580d42711cd5daa2d7d61f32a113c002ed6a67cdb111328fe9d92127660cd1ea6ae
SSDEEP 1536:ezICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDddYufWFwZeHYlBtAsZYaKyAw3u:FqJogYkcSNm9V7Dw4WFkf8wBRCT
TLSH
T1B6E36B21B25ED0B3D47718F22726A17DB3EB4D2C0AA57847E6D40F88BCA49232F4595F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\3L4ZHv9Dp.README.txt

Ransom Note

Your file has been encrypted. Without the decryption key, you will not be able to access your file. Please do not: - Rename the encrypted file - Attempt to decrypt the file yourself - Delete this file - Use third-party recovery tools Any attempt to modify or recover the file will result in permanent data loss. To recover your file, you need to access the following address via Tor:http://mi4il3dyfi2n6obwoe5emodojovnn4rd3z6em33rf2lw2inadthedpad.onion After accessing the address using Tor, you will need to enter your unique authentication ID. Tor download link: https://www.torproject.org Only we can provide the decryption key for your file. Your unique authentication ID: DF80683C49AE86BC86422AC951A60F46

Extracted

Path

C:\3L4ZHv9Dp.README.txt

Ransom Note

Your file has been encrypted. Without the decryption key, you will not be able to access your file. Please do not: - Rename the encrypted file - Attempt to decrypt the file yourself - Delete this file - Use third-party recovery tools Any attempt to modify or recover the file will result in permanent data loss. To recover your file, you need to access the following address via Tor:http://mi4il3dyfi2n6obwoe5emodojovnn4rd3z6em33rf2lw2inadthedpad.onion After accessing the address using Tor, you will need to enter your unique authentication ID. Tor download link: https://www.torproject.org Only we can provide the decryption key for your file. Your unique authentication ID: DF80683C49AE86BC617DB3B738ACE7A1

Targets

- Target
  2026-09-16_89c7bffb602c9ffc364e51fab2a987ea_coinminer_darkside_elex_lockbit
- Size 146KB
- SHA256 f7f6c966bbb6f3e9764512303a942a101e01762746fd60e384c2d6d6675ae962
- MD5 89c7bffb602c9ffc364e51fab2a987ea
- SHA1 4192041845c3c798f7d9637ddb0e314b06b42a90
- SHA512 f174877839fd45b24bbbdf826f154b15b5aea46f3757baf2bc958a6f92099580d42711cd5daa2d7d61f32a113c002ed6a67cdb111328fe9d92127660cd1ea6ae
- SSDEEP 1536:ezICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDddYufWFwZeHYlBtAsZYaKyAw3u:FqJogYkcSNm9V7Dw4WFkf8wBRCT
- TLSH
  T1B6E36B21B25ED0B3D47718F22726A17DB3EB4D2C0AA57847E6D40F88BCA49232F4595F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (3810) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2