lockbit | cd56e92ebd60de7b890a9cf11cdf20d7b4ac83234250a91c5a2d788e9c3367b3

General

Target
2026-09-16_176f1849fc59226b44e71c703caeb7ea_coinminer_darkside_elex_lockbit
Size 146KB
Sample260916-eepyras1bx
SHA256 cd56e92ebd60de7b890a9cf11cdf20d7b4ac83234250a91c5a2d788e9c3367b3
MD5 176f1849fc59226b44e71c703caeb7ea
SHA1 2275ee8ad63e45b0ac939f170028cfbb1c5a74df
SHA512 61b324ca92950c16d5321703489cafd33f0807a912c92dcda01b23a825b3f747254cfbdb38e489d1a0e627cd5e8f66f8e576dabc54e7649cd528dc244d1c033a
SSDEEP 3072:aqJogYkcSNm9V7DMBhWlDBN+ivOAxY+X2T:aq2kc4m9tDyAdBN/v
TLSH
T15AE37C21F15ED0B3D47718F22726B17EB3EA4D2C1AA56807E6E50F48BCA49232F0595F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\bWlSi9vM6.README.txt

Ransom Note

Your file has been encrypted. Without the decryption key, you will not be able to access your file. Please do not: - Rename the encrypted file - Attempt to decrypt the file yourself - Delete this file - Use third-party recovery tools Any attempt to modify or recover the file will result in permanent data loss. To recover your file, you need to access the following address via Tor:http://mi4il3dyfi2n6obwoe5emodojovnn4rd3z6em33rf2lw2inadthedpad.onion After accessing the address using Tor, you will need to enter your unique authentication ID. Tor download link: https://www.torproject.org Only we can provide the decryption key for your file. Your unique authentication ID: C92ABFA657D0E7B61968A0C03CDD1B79

Extracted

Path

C:\bWlSi9vM6.README.txt

Ransom Note

Your file has been encrypted. Without the decryption key, you will not be able to access your file. Please do not: - Rename the encrypted file - Attempt to decrypt the file yourself - Delete this file - Use third-party recovery tools Any attempt to modify or recover the file will result in permanent data loss. To recover your file, you need to access the following address via Tor:http://mi4il3dyfi2n6obwoe5emodojovnn4rd3z6em33rf2lw2inadthedpad.onion After accessing the address using Tor, you will need to enter your unique authentication ID. Tor download link: https://www.torproject.org Only we can provide the decryption key for your file. Your unique authentication ID: C92ABFA657D0E7B6EFCEABE9740B4239

Targets

- Target
  2026-09-16_176f1849fc59226b44e71c703caeb7ea_coinminer_darkside_elex_lockbit
- Size 146KB
- SHA256 cd56e92ebd60de7b890a9cf11cdf20d7b4ac83234250a91c5a2d788e9c3367b3
- MD5 176f1849fc59226b44e71c703caeb7ea
- SHA1 2275ee8ad63e45b0ac939f170028cfbb1c5a74df
- SHA512 61b324ca92950c16d5321703489cafd33f0807a912c92dcda01b23a825b3f747254cfbdb38e489d1a0e627cd5e8f66f8e576dabc54e7649cd528dc244d1c033a
- SSDEEP 3072:aqJogYkcSNm9V7DMBhWlDBN+ivOAxY+X2T:aq2kc4m9tDyAdBN/v
- TLSH
  T15AE37C21F15ED0B3D47718F22726B17EB3EA4D2C1AA56807E6E50F48BCA49232F0595F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (3834) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2