LockFileMalware

A ransomware first observed in July 2021.From MISP Galaxy

Last reported 5 years ago, by Huntress1 report

What the reports say

1 report, newest first · the exact sentence from each

“While analyzing one host that was compromised with both ProxyShell and the LockFile ransomware, we uncovered a unique TTP that we had not seen before for ProxyShell activity.”

HuntressVendor19 Aug 2021
Microsoft Exchange Servers Still Vulnerable to ProxyShell

Indicators in its reports

named in the reports above

37.221.115[.]68in 1 report
45.144.30[.]18in 1 report
84.17.46[.]174in 1 report
116.203.201[.]159in 1 report
203.184.132[.]186in 1 report
8a103fbf4b18871c…dbd6121d4781in 1 report
c5c88f5b01371106…d521f82010aain 1 report
9f7f12011436c0bb…6164e61f918din 1 report
ab767de6193c3f6d…64eb8dfa2498in 1 report
20659e56c780cc96…3e41deee46e9in 1 report

Copy these 10 indicators · defanged

10 indicators, defanged, one per line

37.221.115[.]68
45.144.30[.]18
84.17.46[.]174
116.203.201[.]159
203.184.132[.]186
8a103fbf4b18871c1378ef2689f0bdf062336d7e02a5f149132cdbd6121d4781
c5c88f5b013711060bcf4392caebbc3996936b49c4a9b2053169d521f82010aa
9f7f12011436c0bbf3aced5a9f0be8fc7795a00d0395bfd91ff76164e61f918d
ab767de6193c3f6dff680ab13180d33d21d67597e15362c09caf64eb8dfa2498
20659e56c780cc96b4bca5e4bf48c812898c88cf134a84ac34033e41deee46e9

Thanks — we review every report.

Report a wrong match