LockCryptMalware
LockCrypt is an example of yet another simple ransomware created and used by unsophisticated attackers. Its authors ignored well-known guidelines about the proper use of cryptography. The internal structure of the application is also unprofessional. Sloppy, unprofessional code is pretty commonplace when ransomware is created for manual distribution.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1003OS Credential Dumping
“T1003”
- T1007System Service Discovery
“T1007”
- T1018Remote System Discovery
“T1018”
- T1021.001Remote Desktop Protocol
“T1021.001”
- T1021.004SSH
“T1021.004”
- T1027Obfuscated Files or Information
“T1027”
What the reports say
1 report, newest first · the exact sentence from each-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“For other notes, BabLock used the text from the notes of an older family, LockCrypt.”
Indicators in its reports
named in the reports above- 4874d336c5c7c2f5…61ce9c38b86din 1 report
- 2fd264f58ba82a26…071f67bb67abin 1 report
- 03c41019faf7e4cc…4a20256c1813in 1 report
- 88081a21e500e831…b18a022f25bein 1 report
- aa48acaef62a7bfb…9a78864eb31fin 1 report
- b99d114b267ffd06…974bbce75bf2in 1 report
- 66bcad0829a59c42…bf65f13f3dc6in 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.