Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

LockBit v3.0 Ransomware (<Random Filename>.hVGakg14U)

  • Distribution Method : Unknown
  • MD5 : da0706781bb91736569aa33203b4e4ea
  • Major Detection Name : Ransomware/Win.LockBit.R503945 (AhnLab V3), Trojan:Win32/Lockbit.HA!MTB (Microsoft)
  • Encrypted File Pattern : <Random Filename>.hVGakg14U
  • Malicious File Creation Location :
     - C:\ProgramData\<Random>.tmp
     - C:\ProgramData\hVGakg14U.ico
  • Payment Instruction File : hVGakg14U.README.txt
  • Major Characteristics :
     - Offline Encryption
     - Block processes execution (dbsnmp, mydesktopqos, oracle, outlook, synctime, xfssvccon etc.)
     - Stop multi services (Browser, Dhcp, gpsvc, HomeGroupProvider, MMCSS, Wcmsvc etc.)
     - Delete multi services (EventLog, vmicvss, VSS, WdFilter, WinDefend, wscsvc etc.)
     - Changes desktop background (C:\ProgramData\hVGakg14U.bmp)
     - Interrupt file recovery using "C:\ProgramData\<Random>.tmp"
     - Empty the trash
     - Change encrypted file (.hVGakg14U) icon (HKEY_CLASSES_ROOT\hVGakg14U)