Ransom.PS1.LOCKBIT.B

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It encrypts files with specific file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware adds the following processes:

• "%System%\WindowsPowerShell\v1.0\powershell.exe" -enc {Obfuscated Powershell Script}

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other Details

This Ransomware does the following:

• it encrypts local drives, removable drives and network shares.

Ransomware Routine

This Ransomware encrypts files with the following extensions:

• .pdf
• .txt
• .doc
• .docx
• .odt
• .rtf
• .md
• .csv
• .tsv
• .jpg
• .jpeg
• .tiff
• .mp3
• .xls
• .xlsx
• .ods
• .ppt
• .pptx
• .odp
• .py
• .java
• .cpp
• .c
• .html
• .css
• .js
• .php
• .swift
• .kotlin
• .go
• .rb
• .sh
• .sql
• .db
• .sqlite
• .sqlite3
• .mdb
• .sql
• .zip
• .rar
• .7z
• .tar
• .gz
• .bz2
• .iso
• .torrent
• .ini
• .json
• .xml
• .log
• .bak
• .cfg
• .psd
• .vmdk

It appends the following extension to the file name of the encrypted files:

• .xlockxlock