lockbit | eff42c02fb8757b13f5f7bdc9a4144a646d03eb9944fc543b9f257578eacd504

General

Target
2026-10-30_10270550dc9cd1d459868fffccf302d3_coinminer_darkside_elex_lockbit
Size 148KB
Sample261031-klq3aaas8x
SHA256 eff42c02fb8757b13f5f7bdc9a4144a646d03eb9944fc543b9f257578eacd504
MD5 10270550dc9cd1d459868fffccf302d3
SHA1 ccb6e8a499145cbdb9959ca05e4355e05b126148
SHA512 30f601bb89fb75fdd8d9e39e2e1a9ad2dc0996b4aca987dfa028d786c52d77f43156d5120ac0052eb35fb76466002b70daa878001020b5af413d6722f528beb3
SSDEEP 3072:FqJogYkcSNm9V7DpGtuSVUATnBNkp6fT:Fq2kc4m9tDpGtu8lWp
TLSH
T1FCE37C21E25ED073D47718F22736A17DB3EA4D2C0AA57807EAE50F49BCA49232F4591F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\S3fGALodz.README.txt

Ransom Note

Special Note for you Liabiliti3$ By ShadowByt3$ 2.0 Your data is encrypted. The data will be published on the TOR website if you do not pay the ransom. Links for Tor Browser: sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion You need to contact us and decrypt one file for free on this TOR site with your personal DECRYPTION ID. Download and install TOR Browser: https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Chat link (Tor Browser): sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion If you do not get an answer in the chat room for a long time, the site does not work, and in any other emergency you can contact us via Session. Contacts: Tox ID ShadowByt3$ 2.0: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 Proton (Email) ShadowByt3$ 2.0: [email protected] Do not DELETE or MODIFY any files, it can lead to recovery and irreversible problems! If you do not pay the ransom we will attack your company repeatedly again and again until you pay!

Emails

[email protected]

URLs

http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion

Targets

- Target
  2026-10-30_10270550dc9cd1d459868fffccf302d3_coinminer_darkside_elex_lockbit
- Size 148KB
- SHA256 eff42c02fb8757b13f5f7bdc9a4144a646d03eb9944fc543b9f257578eacd504
- MD5 10270550dc9cd1d459868fffccf302d3
- SHA1 ccb6e8a499145cbdb9959ca05e4355e05b126148
- SHA512 30f601bb89fb75fdd8d9e39e2e1a9ad2dc0996b4aca987dfa028d786c52d77f43156d5120ac0052eb35fb76466002b70daa878001020b5af413d6722f528beb3
- SSDEEP 3072:FqJogYkcSNm9V7DpGtuSVUATnBNkp6fT:Fq2kc4m9tDpGtu8lWp
- TLSH
  T1FCE37C21E25ED073D47718F22736A17DB3EA4D2C0AA57807EAE50F49BCA49232F4591F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2