lockbit | 91c3d9de90635f38e9ac25c69846edb2a950f52b891379e6cdd285961255fb98

Resubmissions

27/10/2026, 01:20

261027-bp25aaxv9n10

27/10/2026, 01:03

261027-bentxazzcs10

15/09/2026, 06:58

260915-hrlcwashqf10

Sharing

Copy URL Twitter E-mail

General

Target
LockBit.iso
Size 10.0MB
Sample261027-bentxazzcs
SHA256 91c3d9de90635f38e9ac25c69846edb2a950f52b891379e6cdd285961255fb98
MD5 f9f13fa9f60023201a8d1168d12c4fe7
SHA1 7c775aa7d704c6f95cf45d68b24a513367ab0be9
SHA512 c368386da4dffc808714e2173210f96f6b7db68af486d520a9069ced2ece52a638ea4b4701da4740e95c9d8ccc5ce76b486e97415606879e0a3c4b9399229062
SSDEEP 98304:olMaClRvQPlsyEsSyEsgP5v6AWyEss6BsAk0Ew0e9Fwh5O0Ew0eel:oeaC0oxLHDk0Ew0M0Ew03
TLSH
T119B66B0AF31295B8C822DCF89DCBA121E3147C5C022675FAB7C05F65BE657D2A32958F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

F:\ReadMeForDecrypt.txt

lockbit

Ransom Note

~~~ You have been attacked by LockBit 5.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~ >>>>> You must pay us. Tor Browser link where the stolen infortmation will be published: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion >>>>> What is the guarantee that we won't scam you? We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on wikipedia https://en.wikipedia.org/wiki/LockBit >>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die. >>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency. >>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as https://electrum.org/ or any other cold cryptocurrency wallet, more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers. >>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation. >>>>> You need to contact us via TOR sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser link for chat with us: http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal identifier to communicate with us ID: BBE99C44EB6B4068C16DC43EEAFE285C <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Advertising: Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us. http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion After registration, you will receive the most flawless and reliable tools for encrypting almost all operating systems on the planet and a platform for negotiating with attacked companies. Version: ChuongDong v1.01 | x64

URLs

http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion
http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion

Extracted

Path

C:\PerfLogs\ReadMeForDecrypt.txt

lockbit

Ransom Note

~~~ You have been attacked by LockBit 5.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~ >>>>> You must pay us. Tor Browser link where the stolen infortmation will be published: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion >>>>> What is the guarantee that we won't scam you? We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on wikipedia https://en.wikipedia.org/wiki/LockBit >>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die. >>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency. >>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as https://electrum.org/ or any other cold cryptocurrency wallet, more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers. >>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation. >>>>> You need to contact us via TOR sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser link for chat with us: http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal identifier to communicate with us ID: BBE99C44EB6B40685F52152116A83903 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Advertising: Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us. http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion After registration, you will receive the most flawless and reliable tools for encrypting almost all operating systems on the planet and a platform for negotiating with attacked companies. Version: ChuongDong v1.01 | x64

URLs

http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion
http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion

Extracted

Path

C:\3LVctaGbv.README.txt

Ransom Note

~~ You have been attacked by LockBit 5.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~ >>>>> You must pay us. Tor Browser link where the stolen infortmation will be published: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion >>>>> What is the guarantee that we won't scam you? We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on wikipedia https://en.wikipedia.org/wiki/LockBit >>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die. >>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency. >>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as https://electrum.org/ or any other cold cryptocurrency wallet, more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers. >>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation. >>>>> You need to contact us via TOR sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser link for chat with us: http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal identifier to communicate with us ID: 28DD271AA3FF81EEE3124733B0CA45A9 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Advertising: Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us. http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion After registration, you will receive the most flawless and reliable tools for encrypting almost all operating systems on the planet and a platform for negotiating with attacked companies.

URLs

http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion
http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion

Extracted

Path

C:\OxqwDm6p4.README.txt

Ransom Note

~~ You have been attacked by LockBit 5.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~ >>>>> You must pay us. Tor Browser link where the stolen infortmation will be published: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion >>>>> What is the guarantee that we won't scam you? We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on wikipedia https://en.wikipedia.org/wiki/LockBit >>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die. >>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency. >>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as https://electrum.org/ or any other cold cryptocurrency wallet, more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers. >>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation. >>>>> You need to contact us via TOR sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser link for chat with us: http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal identifier to communicate with us ID: 1E418B4437B16F7ED5399DFFA674F015 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Advertising: Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us. http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion After registration, you will receive the most flawless and reliable tools for encrypting almost all operating systems on the planet and a platform for negotiating with attacked companies.

URLs

http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion
http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion

Extracted

Path

F:\cAt2crbfu.README.txt

Ransom Note

~~ You have been attacked by LockBit 5.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~ >>>>> You must pay us. Tor Browser link where the stolen infortmation will be published: http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion >>>>> What is the guarantee that we won't scam you? We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on wikipedia https://en.wikipedia.org/wiki/LockBit >>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files! >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die. >>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency. >>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as https://electrum.org/ or any other cold cryptocurrency wallet, more details on https://bitcoin.org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers. >>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation. >>>>> You need to contact us via TOR sites with your personal ID Download and install Tor Browser https://www.torproject.org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser link for chat with us: http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Your personal identifier to communicate with us ID: 7E363F262150642A3EF8D61E59E42D94 <<<<< >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >>>>> Advertising: Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us. http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion After registration, you will receive the most flawless and reliable tools for encrypting almost all operating systems on the planet and a platform for negotiating with attacked companies.

URLs

http://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion
http://lockbitsuppyx2jegaoyiw44ica5vdho63m5ijjlmfb7omq3tfr3qhyd.onion
http://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion

Targets

- Target
  LockBit.iso
- Size 10.0MB
- SHA256 91c3d9de90635f38e9ac25c69846edb2a950f52b891379e6cdd285961255fb98
- MD5 f9f13fa9f60023201a8d1168d12c4fe7
- SHA1 7c775aa7d704c6f95cf45d68b24a513367ab0be9
- SHA512 c368386da4dffc808714e2173210f96f6b7db68af486d520a9069ced2ece52a638ea4b4701da4740e95c9d8ccc5ce76b486e97415606879e0a3c4b9399229062
- SSDEEP 98304:olMaClRvQPlsyEsSyEsgP5v6AWyEss6BsAk0Ew0e9Fwh5O0Ew0eel:oeaC0oxLHDk0Ew0M0Ew03
- TLSH
  T119B66B0AF31295B8C822DCF89DCBA121E3147C5C022675FAB7C05F65BE657D2A32958F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral1
- Target
  2513d6678b476a432af2e84fff485b44
- Size 158KB
- SHA256 b33136d1d5c4b3a8192ef0090ef4e4a6f0985cee76fd6455ea48186fc4b5192f
- MD5 2513d6678b476a432af2e84fff485b44
- SHA1 298037c0ae2c8f50f7aaed55adb51f8f4f6e2020
- SHA512 0dadd00b2889dafdcf441cc5c44986aa1b6135b27b2770ccd69c6c3f022089eee25058577c9d8455dba55144bd9edfe55e77edf9a12ca36a48cace0d9edcc5f8
- SSDEEP 3072:5DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP33686kjTRM7zT7kjwsMCOW9xW:z5d/zugZqll3OkjTeo8sMS9
- TLSH
  T18DF37D31B151D137CA6638F1A729B3B0739A9E2C12A9A463F6E4CF4B35738236F15847
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware
- Renames multiple (133) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral2
- Target
  274e5ff2aa33e7ec980700e617eb2214
- Size 76KB
- SHA256 91f627056f548c5f35a93ae59459b96d7d43d5cd24e78974ffc3d709829c1bd5
- MD5 274e5ff2aa33e7ec980700e617eb2214
- SHA1 c0bfb0c35d000ebf3240c2a2c308f258e774b782
- SHA512 7e0536070a85783024cd86579eca02285decaef1935b75a575456d162d669637647331b8d22b61ba2245cfb2d50bb05077a2188ed56b80d925547746d28b07a7
- SSDEEP 1536:r2AgMun5RyBxIlJZTJ7EdULv8gPT9UMGCS17yP2smfxGa+D3e/DeQP8Y:r4JZTJ7EdULv8gPT9MFYBuqw
- TLSH
  T18C73D6BFCF6E516ED183B178D6DB80F7C56061BC8361015F6B04151AAB3A4E18FA932B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  2908589ca1a1f5d98c7f71563a3abac6
- Size 76KB
- SHA256 ceedba3300715db7c323e7e23f28427b81cb73463004fa4141c7b4ba446891bd
- MD5 2908589ca1a1f5d98c7f71563a3abac6
- SHA1 e002c4d2529eb80c2a9066393f5d8fa7f725f1fd
- SHA512 1db2857f51ede1e653662ee45a2a48dfb68c30a9f43a82a2d1169a18b7e6b89b32fc6dc8296638b403f4c38bb09e66b20d773265c086a740b47f2b049180c078
- SSDEEP 1536:nFvgMun5RyBxIlJZTJ7EdULv8gPT9UMGCi17yP2smfxGa+Dde/jeQP8Y:nSJZTJ7EdULv8gPT9M1YBEKw
- TLSH
  T13973D6BFCF6E516ED183B178D6DB80F7C56061BC8361015F6B04151AAB3A4E18FA932B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  48b0a4505a96a640300e43e2af712276
- Size 158KB
- SHA256 9dc03bf850b41f93331ddca0fb401d2ce08fba97ebde53b675c611583f892a80
- MD5 48b0a4505a96a640300e43e2af712276
- SHA1 3fdf2e4194d87b8c02629293f4d1da33d4cd2ae4
- SHA512 1bb2d44f153d95092802778358c80c41ff04b2249aec3f03907ebfab51cb8d41476c99247936c4018baa0b48784f7d8cd42fc5ba8de53de5aa494488b9044d6b
- SSDEEP 3072:+DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368JfsO6RlmluE2g/Z81fW:I5d/zugZqll31UO8muhgx8
- TLSH
  T114F37D217152D037CA6634F2A329B3B1738A9E2C13A9A467FAD4CF4B35738236F15947
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware
- Renames multiple (133) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral5
- Target
  5e1f61b9c1c27cad3b7a81c804ac7b86
- Size 691KB
- SHA256 180e93a091f8ab584a827da92c560c78f468c45f2539f73ab2deb308fb837b38
- MD5 5e1f61b9c1c27cad3b7a81c804ac7b86
- SHA1 c1888ba296f57e87a84411ddfce3cabc4536b142
- SHA512 cc3fb6954fe4d1754c816c9bbd05ba1ec320d2a71410993026c02137629edf5abb1d6b46ba45b6ce460f58b9d8e62214d9600785a79ef0571390db8779bc7c31
- SSDEEP 12288:0LxxJniMoRpKP9W1u19Ol9tyHDdZIYTbviWYbn8wBNsavTduK14UqMs5XRhazKj:0LIJvyHDPVXahbnNBNgfUjs5Xuz
- TLSH
  T129E4DFADED0699A0C453F1BCFE0BB4D053157EA44F3AB2A7781915E20A738E43A753C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of SetThreadContext
behavioral6
- Target
  8f718979876dd1050ce4f729d69e0072
- Size 698KB
- SHA256 3194ab5e2a174e9f859e8fb6d2a33ac7aa15dc1af0da512910cf869fb15f1ebd
- MD5 8f718979876dd1050ce4f729d69e0072
- SHA1 fda895c21e11f8af195420d5b556604e8aea466d
- SHA512 26df353b61cf3f5060c98a9dd57734960ef75c8d3d8d53199bf51e314a9aff30201ca670d5cf2d4c87732e365fc2e8199dd5f392c514f44ab811287f67eb9792
- SSDEEP 12288:4IC61NP3XxNWFAol3miH/vMnnb0jjv+RMRgSAiWYbn8wBNsavTduK14UqMs5KoQd:PLb0/Hg0hbnNBNgfUjs5KP5QrW/P
- TLSH
  T105E4D069ED469C60CB93A47C795AF5D05200395C9F1BA2FB7C0D09E12E738893BB1F86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of SetThreadContext
behavioral7
- Target
  95daa771a28eaed76eb01e1e8f403f7c
- Size 693KB
- SHA256 7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82
- MD5 95daa771a28eaed76eb01e1e8f403f7c
- SHA1 cdd5717fd3bfd375c1c34237c24073e92ad6dccc
- SHA512 cb7258f8c7d5e77be30df63f73a16667be839a51613509012a41d90cd8456400c237c681d1cdae10213b83e2e2315760c2f4acee02e55f1430c0e90bc69eb35c
- SSDEEP 12288:q/tJbVY7R6CCJ5RqRhoS2KMPKZb8VEtiWYbn8wBNsavTduK14UqMs5+p6uaYwsjE:q/XuwyZAVEEhbnNBNgfUjs5+8RsXsx
- TLSH
  T1D0E4D0ADFD4A8960D553F5BCBE1EB49153017AB80F39A2B7740925E10E738D83AB13C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of SetThreadContext
behavioral8
- Target
  a1539b21e5d6849a3e0cf87a4dc70335
- Size 400KB
- SHA256 90b06f07eb75045ea3d4ba6577afc9b58078eafeb2cdd417e2a88d7ccf0c0273
- MD5 a1539b21e5d6849a3e0cf87a4dc70335
- SHA1 561db92000409fe7093964452143ec371f930681
- SHA512 abec982850df65ca1d4d357a8bf78fe0082a5363afe3de5a6d99d2f7a925346f4f43478d3e7ba78bc1e9f36ae4a125130b87962ae4c91f45fc7fd3a26f7a9a04
- SSDEEP 6144:9/D84JsDWucUi+qEg4SRg/zRJNT26aflCbt:dD8Ss8lsAyfF4du
- TLSH
  T1A6944907A2A320FCCEC3C4322FAB3163527BBD4D231BBEE1379A5621659BA711761745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  bf4443f6dbbdee8816aa9a1098374326
- Size 76KB
- SHA256 50855b7b0397025da43e6d79a45f8d6bafc4752b30b5c4658c5b733040669178
- MD5 bf4443f6dbbdee8816aa9a1098374326
- SHA1 befcb29ff5c904e9c840f45ae149e7a99e4b778f
- SHA512 b63fd549f2ad78990ff5ad2d1818f35d4c54c2c12fa6ec13638ec1325e6180b6caf80a268b442028a0c2582e2406ed17326f7f31023d3b5efd9a0f0bc4d64a7a
- SSDEEP 1536:q7jlMun5RyBxIlJZTJ7EdULv8gPT9UMGCZ17yP2sGfxGa+UyTsDeQP:q5JZTJ7EdULv8gPT9MOYaItw
- TLSH
  T17373E6BFCF6E516ED183B178D6DB40F7C56061BC8361016F6B04151AAB3A4E18FA932B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10
- Target
  c462c6b02b35df2910689947c5090fae
- Size 5.0MB
- SHA256 8dacc9ed62ced2922ae89b4fc4c99ed5242b3eb8abb8cabd9a8dac08b699b026
- MD5 c462c6b02b35df2910689947c5090fae
- SHA1 5b14cec6279e1f14e6d7270049ea6a220ac60682
- SHA512 2afe3485ba5be2c2465b9c3cd664a5ed371c57c1a3587413e1f1e6c6684ea87c7418678262172b129a6d7ae3727269fc04b24a12eb9f97f90715c6ffaf9d62d4
- SSDEEP 24576:BjsFMuOmHEw0UxI38mhK5XE3qZvGID29Q:Bjs60Ew0Ux68miEo
- TLSH
  T14936C60AF35196E8CC36DDF988CAA520E3147C58016579FAA7C05F65BF587C2A31A8CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery lockbit persistence privilege_escalation ransomware spyware stealer
- Family: Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral11
- Target
  ca93d47bcc55e2e1bd4a679afc8e2e25
- Size 376KB
- SHA256 4dc06ecee904b9165fa699b026045c1b6408cc7061df3d2a7bc2b7b4f0879f4d
- MD5 ca93d47bcc55e2e1bd4a679afc8e2e25
- SHA1 41e1e094c19fffde494c24ef4cab0d7577d5a025
- SHA512 cb21b5cc6992327741e173a69ebe79283fbd665a35ce6e6d489626946873c0097c19fa66252507236213c2a7e03258c6660a8fa61813108843efd0932fdfb861
- SSDEEP 6144:UIUFThyET/ZOhh5++4hg3nTBiHnqAHDYpzKaN7arPSnSURUd:3UFsmZOhh5+TWkCz6zunc
- TLSH
  T18A845A07A29320FCCEC385322FAB3113626BBE4E271EBED1379A9621758B6711771751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  e47032b3d1b9cbbcf77741d5d260004d
- Size 1.1MB
- SHA256 b3651b3d1a93b9033f62e3e930a747ef291787957d2dcbef237b6811e52977c5
- MD5 e47032b3d1b9cbbcf77741d5d260004d
- SHA1 93b4dcdc5f9368bc8a75a992b64cf7ba833fd377
- SHA512 521b74b49e1c50281516e8296033d6adde0cffb2369602ef570fd8f11208374491f423e7d067846e417033d01d8af7ba228e37b3582d892052aa2e8e15d7d337
- SSDEEP 12288:BVQuU5FMuw8vgp4oaEw0UxI3DKP0SqnhK5vPszr3hYpexmVvGIA+V18k2BTFi2:BjsFMuOmHEw0UxI38mhK5XE3qZvGID2
- TLSH
  T1B835B60AF35196E8CC36DDF988CAA520E3147C58016579FAA7C05F65BF587C2A31A8CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery lockbit persistence privilege_escalation ransomware spyware stealer
- Family: Lockbit
  Ransomware family with multiple variants released since late 2019.
  ransomware lockbit
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral13
- Target
  eb0c1d82187ec3fe980eed2419875e4b
- Size 158KB
- SHA256 cd4756e895e0ac4878d5914365577f752094d8cb507b69dd0649dc9cbc41bbcc
- MD5 eb0c1d82187ec3fe980eed2419875e4b
- SHA1 f9e95b6e84024c3c900c563b2600b4ab6db0c3b3
- SHA512 155f4e0b023c1576021348198a62ef5df259aa522b13e7679ed2ee9ac6b8b94f2b98c6084ec18fe189e1a24422ce061384e4ec923442f50daeb27fc1f780abe3
- SSDEEP 3072:JDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368DXl6axtwVi8SsnnEHA8W:D5d/zugZqll3vX9xOY6nEH
- TLSH
  T1E1F37D217112D137CA6738F2A729B3B073899E2C12A9A467F6E4CF4B35738236F15947
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware
- Renames multiple (147) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral14