LockBit | 威胁等级: critical | 类型: Ransomware

加密标识符

SHA2563c4fb5a1a8cdc44675df9d61c55a83b6f017a84cb01b06053b8f3953f9794d90
MD5a9fb78ede24ebca4b2802637a0752c45
文件类型exe
大小843.4 KB
首次发现2022-10-04
文件名__입사지원서(221003) 경력사항도 같이 기재하였습니다 잘 부탁드립니다.exe
标签exe, lockbit

恶意软件家族: LockBit

LockBit, en fazla saldırıdan sorumlu ransomware'dir.

类型Ransomware
编程语言C++
目标平台Windows/Linux
C2 协议
用途Çifte şantaj ransomware
首次发现年份2019
别名LockBit 3.0

威胁指标 (IOC)

  • SHA256: 3c4fb5a1a8cdc44675df9d61c55a83b6f017a84cb01b06053b8f3953f9794d90
  • MD5: a9fb78ede24ebca4b2802637a0752c45

系统清理指南

  1. Sistemi ağdan DERHAL ayırın — diğer cihazlara yayılmayı durdurun
  2. 不要支付赎金——无法保证恢复文件
  3. 隔离受影响的驱动器
  4. Kullanılan fidye yazılımı ailesini belirleyin (nomoreransom.org)
  5. 尝试可用的解密工具(NoMoreRansom 项目)
  6. Yetkililere ihbarda bulunun
  7. Temiz bir yedekten kurtarın

YARA 规则提示

rule LockBit_SHA256 {
    meta:
        description = "LockBit sample: 3c4fb5a1a8cdc446"
        threat_level = "critical"
        first_seen = "2022-10-04"
    condition:
        hash.sha256(0, filesize) == "3c4fb5a1a8cdc44675df9d61c55a83b6f017a84cb01b06053b8f3953f9794d90"
}

LockBit — 恶意软件档案

LockBit 3.0 (LockBit Black). bl3.exe builder. CryptProtectMemory DPAPI key protection. WinRAR SFX delivery.

恶意软件类型
Ransomware
编程语言
C++
C2协议
目标系统
Windows/Linux
别名 (AKA)
LockBit 3.0

技术细节

C, RSA-2048 + AES-256 sifreleme (hibrid), vssadmin ile shadow copy silme, Active Directory enum, LockBit Builder ile ozel varyant uretimi, multi-threaded encryption, ransom note TXT/HTA

能力与行为

Dosya Şifreleme (AES/RSA)
Gölge Kopya Silme
Yedek Kaldırma
Fidye Notu Oluşturma
Kalıcılık Sağlama
Ağ Paylaşımı Şifreleme
Anti-Analiz Teknikleri
Çift Gasp (Data Leak)

IOC列表 (6 个指标)

IOC — LockBit
# SHA256 3c4fb5a1a8cdc44675df9d61c55a83b6f017a84cb01b06053b8f3953f9794d90 # MD5 a9fb78ede24ebca4b2802637a0752c45 # IP 185.220.101.45 # IP 45.153.160.140 # DOMAIN lockbit3olp7oetlc.onion # EMAIL support@lockbit3.io
类型备注
sha256 3c4fb5a1a8cdc44675df9d61c55a83b6f017a84cb01b06053b8f3953f9794d90
md5 a9fb78ede24ebca4b2802637a0752c45
ip 185.220.101.45 LockBit 3.0 C2 - Tor proxy
ip 45.153.160.140 LockBit aktif leak site sunucu
domain lockbit3olp7oetlc.onion LockBit 3.0 veri sizdirma sitesi
email support@lockbit3.io LockBit destek e-postasi

C2服务器 (该家族共有 2 台已记录服务器)

地址 类型 端口 协议 状态 国家
35.227.107.189 ip 443 HTTPS sinkholed US
89.185.85.239 ip 443 HTTPS sinkholed NL

C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。

标签
lockbitransomwaremalwarecriticalsha256analizzenginleştirilmiş