lockbit | c2006d3fd1a8d1943421da6154751e7b53cc799a8bac833a6a95ef1dd2e06c45

General

Target

2024-06-13_603ab1d26637ce590df341e468795968_darkside
Size

1.2MB
Sample

240613-ax6l1a1crl
MD5

603ab1d26637ce590df341e468795968
SHA1

1713ba54373bbdfed5b07e6244e1597ac94f5e2c
SHA256

c2006d3fd1a8d1943421da6154751e7b53cc799a8bac833a6a95ef1dd2e06c45
SHA512

81e29123cb6ce89e2442077dfb647b94752c0578507d2294135af8ef3ffb420f6f16d6d0a06be6a570143798adb63db3d874274bb9bab42bf190633419460268
SSDEEP

24576:Pj4SJslvwqeH5TDdy6gGYXI152bFYEGsMOPRgH8vt+t7d1LeEqotPntpMWhP+c3O:P8J7IaOac4Mn3tAjXLz

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\xa1Xx3AXs.README.txt

Ransom Note

~~~ LockBit 4.0 Ransomware since 2024~~~ >>>> Your data are stolen and encrypted Price = 1000 $ Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2 Email = [email protected] >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> Your personal DECRYPTION ID: A3138014A48684D6D525F3F372263313 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Emails

[email protected]

Wallets

328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2

Targets

- Target
  
  2024-06-13_603ab1d26637ce590df341e468795968_darkside
- Size
  
  1.2MB
- MD5
  
  603ab1d26637ce590df341e468795968
- SHA1
  
  1713ba54373bbdfed5b07e6244e1597ac94f5e2c
- SHA256
  
  c2006d3fd1a8d1943421da6154751e7b53cc799a8bac833a6a95ef1dd2e06c45
- SHA512
  
  81e29123cb6ce89e2442077dfb647b94752c0578507d2294135af8ef3ffb420f6f16d6d0a06be6a570143798adb63db3d874274bb9bab42bf190633419460268
- SSDEEP
  
  24576:Pj4SJslvwqeH5TDdy6gGYXI152bFYEGsMOPRgH8vt+t7d1LeEqotPntpMWhP+c3O:P8J7IaOac4Mn3tAjXLz
Score

10^/10

ransomware spyware stealer
- Detects executables packed with BoxedApp
- Renames multiple (8832) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects executables packed with BoxedApp

Renames multiple (8832) files with added filename extension

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Drops file in System32 directory

Sets desktop wallpaper using registry

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2