다시 돌아온 LockBit 4.0 랜섬웨어 간단 분석

오늘은 그냥 간단하게 다시 돌아온 LockBit 4.0 랜섬웨어(Ransomware)에 대해 알아보겠습니다.
2019년 등장한 락빗(LockBit) 은 처음 등장을 했고 섬웨어를 공격자에게 판매하여 수입을 얻는
RaaS(Ransomware as a Service) 형태로 운영을 하는 것이 특징이며 예전에는 입사지원서로 위장한 메일등으로 파일들을 첨부해서 발송해서 사용자가 실행을 해서 랜섬웨어에 감염이 되는 방식을 따릅니다.
LockBit은 미국 정부 소속 DSIB 와 같은 평판이 좋은 표적을 포함하여 더 자주 피해를 입기 시작
일단 제가 사용한 랜섬웨어 해쉬값은 다음과 같습니다.
MD5:8ff61e4156c10b085e0c2233f24e8501
SHA-1:69d50a8efd73c619aa36113ec04368db83d9b331
SHA-256:3552dda80bd6875c1ed1273ca7562c9ace3de2f757266dae70f60bf204089a4a
LockBit은 미국 정부 소속 DSIB와 같은 평판이 좋은 표적을 포함하여 더 자주 피해를 입기 시작했으며 크로노스 작전 이전에는 일반적인 업로드 기능이었던 것과 달리 피해자의 데이터가 최근 자신의 사이트에 나타나는 것으로 확인

LockBit 4.0 랜섬웨어 실행전

Operation Cronos(크로노스 작전)라고 알려진 합동 작전을 통해 검거가 되었는데 최근에 활동을 시작을 했습니다. 일단 간단하게 윈도우 샌드박스 기능을 이용을 해서 그림 몇 개를 넣고 해당 랜섬웨어를 실행을 했습니다. 실험을 해보면 일단 실행이 되면 사진 파일들이 전부 암호화되는 것을 확인을 할 수가 있으며 랜섬노트를 통해서 해당 락빗 랜섬웨어 에 대한 파일을 복원화 하는 조건으로 랜섬노트가 적혀져 있는것을 확인을 할수가 있습니다.

LockBit 4.0 랜섬웨어 실행후

~~~ You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019 ~~~~

>>>>> You must pay us.

Tor Browser Links BLOG where the stolen infortmation will be published:
( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )
hxxp://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id(.)onion/
hxxp://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id(.)onion/
hxxp://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid(.)onion/
hxxp://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid(.)onion/
hxxp://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad(.)onion/
hxxp://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad(.)onion/
hxxp://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd(.)onion/
>>>>> What is the guarantee that we won't scam you?
We are the oldest extortion gang on the planet and nothing is more important to us than our reputation. We are not a politically motivated group and want nothing but financial rewards for our work. If we defraud even one client, other clients will not pay us. In 5 years, not a single client has been left dissatisfied after making a deal with us. If you pay the ransom, we will fulfill all the terms we agreed upon during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators' salaries. You can get more information about us on Elon Musk's Twitter at hxxps://twitter(.)com/hashtag/lockbit?f=live.
>>>>> Warning! Do not delete or modify encrypted files, it will lead to irreversible problems with decryption of files!
>>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you. They will forbid you from paying the ransom and will not help you in any way, you will be left with encrypted files and your business will die.
>>>>> When buying bitcoin, do not tell anyone the true purpose of the purchase. Some brokers, especially in the US, do not allow you to buy bitcoin to pay ransom. Communicate any other reason for the purchase, such as: personal investment in cryptocurrency, bitcoin as a gift, paying to buy assets for your business using bitcoin, cryptocurrency payment for consulting services, cryptocurrency payment for any other services, cryptocurrency donations, cryptocurrency donations for Donald Trump to win the election, buying bitcoin to participate in ICO and buy other cryptocurrencies, buying cryptocurrencies to leave an inheritance for your children, or any other purpose for buying cryptocurrency. Also you can use adequate cryptocurrency brokers who do not ask questions for what you buy cryptocurrency.
>>>>> After buying cryptocurrency from a broker, store the cryptocurrency on a cold wallet, such as hxxps://electrum(.)org/ or any other cold cryptocurrency wallet, more details on hxxps://bitcoin(.)org By paying the ransom from your personal cold cryptocurrency wallet, you will avoid any problems from regulators, police and brokers.
>>>>> Don't be afraid of any legal consequences, you were very scared, that's why you followed all our instructions, it's not your fault if you are very scared. Not a single company that paid us has had issues. Any excuses are just for insurance company to not pay on their obligation.
>>>>> You need to contact us via TOR darknet sites with your personal ID
Download and install Tor Browser hxxps://www(.)torproject(.)org/
Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world.
Tor Browser personal link for CHAT available only to you:
( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )
hxxp://ytzzxv6ugr6dopoxxcdojrxwovcqr5l3l4p4sbm43ykjndo6qbmxhyad(.)onion
Tor Browser Links for CHAT
( often times to protect our web sites from ddos attacks we include ACCESS KEY -ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )
hxxp://lockbitsprnigidq6imswpysqjg3sewkeagtfbamlybwm7fnonglhlyd(.)onion
hxxp://lockbitspqldd3mm223vmzcvwntd7honhhan3ke72vpnrxexlrsu5ryd(.)onion
hxxp://lockbitsppsg2kfcafzzdettjbgc4tx2cl6tfm4v4py6xtndbhnnhsid(.)onion
hxxp://lockbitsppra2sj6gkfrgtavqds7rcnvhaxdio7jvu2xrozdr2ld3ead(.)onion
hxxp://lockbitspomtxfihje6wepecgif7vuqci6zyl7qgenne5b6lxngf4yqd(.)onion
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>> Your personal identifier to communicate with us ID: FC8E43EC21BE904786F7543157A2DDB5 <<<<<
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>> Want a lamborghini, a ferrari and lots of titty girls? Sign up and start your pentester billionaire journey in 5 minutes with us.
( often times to protect our web sites from ddos attacks we include ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA )
hxxp://lockbitapyx2kr5b7ma7qn6ziwqgbrij2czhcbojuxmgnwpkgv2yx2yd(.)onion
hxxp://lockbitapyum2wks2lbcnrovcgxj7ne3ua7hhcmshh3s3ajtpookohqd(.)onion
hxxp://lockbitapp24bvbi43n3qmtfcasf2veaeagjxatgbwtxnsh5w32mljad(.)onion
hxx://lockbitapo3wkqddx2ka7t45hejurybzzjpos4cpeliudgv35kkizrid(.)onion
hxxp://lockbitapiahy43zttdhslabjvx4q6k24xx7r33qtcvwqehmnnqxy3yd(.)onion
Version: LockBitGreen4.0-rc-577

LockBit 랜섬웨어 노트

대충 번역
~~~ LockBit 4.0에 공격을 받았습니다. 2019년 이후 가장 빠르고 안정적이며 불멸의 랜섬웨어입니다 ~~~~
>>>>> 반드시 지불해야 합니다.
도난당한 정보가 게시되는 Tor 브라우저 링크 블로그:
( 종종 DDoS 공격으로부터 웹사이트를 보호하기 위해 ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA를 포함합니다. )
hxxp://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id(.)onion파/
hxxp://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id(.)onion/
hxxp://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid(.)onion/
hxxp://lockbit435xk3ki62yun7z5nhwz6jyj dp2c64j5vge536if2eny3gtid(.)onion/
hxxp://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad(.)onion/
hxxp://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad(.)onion/
hxxp://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd(.)onion/
>>>>> 우리가 당신을 사기 치지 않을 것이라는 보장은 무엇입니까?
우리는 지구상에서 가장 오래된 강탈 조직이며 우리의 평판보다 더 중요한 것은 없습니다. 우리는 정치적으로 동기가 부여된 그룹이 아니며 우리의 일에 대한 재정적 보상만을 원합니다. 한 명의 고객이라도 사기를 치면 다른 고객은 우리에게 돈을 지불하지 않을 것입니다. 5년 동안 우리와 거래를 한 후 불만을 품은 고객은 단 한 명도 없었습니다. 몸값을 지불하면 협상 과정에서 합의한 모든 조건을 이행할 것입니다. 이 상황을 단순히 시스템 관리자를 위한 유료 교육 세션으로 여기십시오. 회사 네트워크의 잘못된 구성으로 인해 우리가 여러분을 공격할 수 있었기 때문입니다. 우리의 펜테스팅 서비스는 여러분이 시스템 관리자의 급여를 지불하는 것과 같은 방식으로 지불해야 합니다. Elon Musk의 Twitter hxxps://twitter(.)com/hashtag/lockbit?f=live에서 우리에 대한 자세한 정보를 얻을 수 있습니다.
>>>>> 경고! 암호화된 파일을 삭제하거나 수정하지 마십시오. 파일 복호화에 돌이킬 수 없는 문제가 발생할 수 있습니다!
>>>>> 경찰이나 FBI에 도움을 요청하지 말고 우리가 여러분을 공격했다는 사실을 누구에게도 말하지 마십시오. 그들은 몸값을 지불하는 것을 금지하고 어떤 식으로든 당신을 돕지 않을 것입니다. 당신은 암호화된 파일을 가지고 있을 것이고 당신의 사업은 망할 것입니다.
>>>>> 비트코인을 살 때, 누구에게도 구매의 진짜 목적을 말하지 마십시오. 특히 미국에서 일부 브로커는 몸값을 지불하기 위해 비트코인을 사는 것을 허용하지 않습니다. 암호화폐에 대한 개인적 투자, 선물로 비트코인, 비트코인을 사용하여 사업을 위한 자산을 사는 것, 컨설팅 서비스에 대한 암호화폐 지불, 다른 서비스에 대한 암호화폐 지불, 암호화폐 기부, 도널드 트럼프가 선거에서 이기기 위한 암호화폐 기부, ICO에 참여하고 다른 암호화폐를 사기 위해 비트코인을 사는 것, 자녀에게 상속 재산을 남기기 위해 암호화폐를 사는 것, 또는 암호화폐를 사는 다른 목적과 같이 구매에 대한 다른 이유를 전달하십시오. 또한 암호화폐를 사는 것에 대해 질문하지 않는 적절한 암호화폐 브로커를 사용할 수 있습니다.
>>>>> 브로커로부터 암호화폐를 구매한 후, hxxps://electrum(.)org/ 또는 다른 콜드 암호화폐 지갑과 같은 콜드 월렛에 암호화폐를 보관하세요. 자세한 내용은 hxxps://bitcoin(.)org에서 확인하세요. 개인 콜드 암호화폐 지갑에서 몸값을 지불하면 규제 기관, 경찰 및 브로커의 문제를 피할 수 있습니다.
>>>>> 법적 결과를 두려워하지 마세요. 매우 두려웠기 때문에 모든 지침을 따랐고, 매우 두려운 것은 여러분의 잘못이 아닙니다. 저희에게 돈을 지불한 회사 중 단 하나도 문제가 없었습니다. 모든 변명은 보험 회사가 의무를 이행하지 않기 위한 것일 뿐입니다.
>>>>> 개인 ID로 TOR 다크넷 사이트를 통해 저희에게 연락해야 합니다.
Tor 브라우저 hxxps://www(.)torproject(.)org/를 다운로드하여 설치하세요.
채팅방에 글을 쓰고 답변을 기다리세요. 저희가 답변을 보장해 드리겠습니다. 아무도 알 수 없는 저희와의 통신을 위한 고유 ID가 필요하다면 채팅에서 물어보세요. 저희가 여러분을 위한 비밀 채팅을 생성하고 개인 일회성 메모 서비스를 통해 ID를 제공해 드리겠습니다. 여러분 외에는 아무도 이 ID를 알 수 없습니다. 때로는 저희의 답변을 기다려야 할 수도 있습니다. 저희는 할 일이 많고 전 세계 수백 개의 회사를 공격하기 때문입니다.
귀하에게만 제공되는 채팅용 Tor 브라우저 개인 링크:
( 종종 DDoS 공격으로부터 웹사이트를 보호하기 위해 ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA를 포함합니다 )
hxxp://ytzzxv6ugr6dopoxxcdojrxwovcqr5l3l4p4sbm43ykjndo6qbmxhyad(.)onion
채팅용 Tor 브라우저 링크
( 종종 DDoS 공격으로부터 웹사이트를 보호하기 위해 ACCESS KEY - ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA를 포함합니다 ) )
hxxp://lockbitsprnigidq6imswpysqjg3sewkeagtfbamlybwm7fnonglhlyd(.)onion
hxxp://lockbitspqldd3mm223vmzcvwntd7honhhan3ke72vpnrxexlrsu5ryd(.)onion
hxxp://lockbitsppsg2kfcafzzdettjbgc4tx2cl6tfm4v4py6xtndbhnnhsid(.)onion
hxxp://lockbitsppra2sj6gkfrgtavqds7rcnvhaxdio7jvu2xrozdr2ld3ead(.)onion
hxxp://lockbitspomtxfihje6wepecgif7vuqci6zyl7qgenne5b6lxngf4yqd(.)onion

LockBit 4.0 랜섬웨어 사이트 접속

아마도 결국은 비트코인(Bit coin) 즉 암호화폐(가상화폐)를 탈취하기 목적이며 이제 백악관에 재입성하는 트럼프 대통령 당선인이 미국 전략적 비축자산과 함께 시세가 올라서 다시 영업을 하는 것이 아닌지 추측이 됩니다.

아무튼 요즈임 기본적으로 백신 프로그램(안티 바이러스 프로그램)에서는 기본적으로 랜섬웨어 차단 기능이 있지만 만약 해당 기능 이 나는~믿지 못하겠다고 생각이 되면 기본적으로 설정된 랜섬웨어 차단 부분을 해제를 하고 지난 시간에 소개해드린 앱체크(AppCheck) 프로그램을 사용을 하는 것을 추천해 드리며 무료 버전은 조금은 기능 제한이 있으니 3만 원 정도 투자하면 기능 제한 없이 사용을 할 수가 있으니 편안하게 사용을 할수가 있을 것입니다. 결국은 기본적인 보안 수칙을 잘 지키는 것이 안전하게 사용을 하는 방법 일 것입니다.