Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
To avoid leaking capabilities and being tracked using the import hash, this sample manually resolves Windows APIs using the PEB... the sample also XORs the result with the 0x10035FFF constant... allocates a small memory chunk and builds a small piece of trampoline code which calculates and jumps to the target API.
The sample uses the restart manager family of APIs... to get a list of processes with open handles to the file being encrypted. It then terminates all of those processes.
The sample uses the restart manager family of APIs (RmStartSession(), RmRegisterResource(), RmGetList()) to get a list of processes with open handles to the file being encrypted.
After decrypting its configurations, the sample parses its command line arguments and enumerates target paths to encrypt files... For each file in the current target directory, it verifies the filename against the lists of hashes to avoid.
The target of this analysis is a variant of the LockBit v3 ransomware... The sample encrypts files using a combination of symmetric and asymmetric cryptography... It divides each file into chunks... The sample encrypts chunks of the before group and after groups using Salsa20.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.