#
Lockbit Component Cleanup
#
Stealbit Cleanup
To remove Stealbit you need to remove the binary and the config file.
You can do this using the Remove-Item
PowerShell cmdlet.
Remove-Item -Path C:\path\to\connhost.exe
Remove-Item -Path C:\path\to\SB.conf
#
LockBit Cleanup
To undo LockBit encryption, run the following PowerShell command on a domain-connected host as the same domain admin user, which will clean up each host. Make sure to replace the target hosts and C2 address with the proper names according to the target environment.
$attackerC2 = "attacker c2 IP";
$cleanupHosts = @(
"host1",
"host2",
"hostN"
);
$cleanupHosts | %{
Invoke-Command -ComputerName $_ -ScriptBlock {
Write-Host "[INFO] Performing cleanup on $(hostname)"
# Re-enable and restart VSS service
Write-Host "[INFO] Renabling and restarting VSS"
sc.exe config vss start= auto;
sc.exe start vss;
# Determine which user key has the RSA information
$userKeys = $(reg query "HKU");
$rsaKey = "";
if ([string]::IsNullOrWhitespace($userKeys)) {
Write-Host "[ERROR] Failed to find user registry keys. Skipping decryption.";
} else {
$userKeys | ?{ -not [string]::IsNullOrWhitespace($_) } | %{
$tempKey = "$_\Software\BlockBlit";
if (reg.exe query "$tempKey" 2>$null) {
Write-Host "[INFO] Found LockBit RSA key at $tempKey";
$rsaKey = $tempKey;
}
}
}
if ($rsaKey) {
# Run decryption binary
Write-Host "[INFO] Downloading and executing decryption binary"
curl "http://$attackerC2/lockbit_decryptor.exe" -o "C:\Users\Public\lockbit_decryptor.exe";
C:\Users\Public\lockbit_decryptor.exe -reg "$rsaKey";
if ($LASTEXITCODE -eq 0) {
Write-Host "[INFO] Successfully ran decryption binary. Removing RSA keys from registry";
if (reg.exe query "$rsaKey" 2>$null) {
Write-Host "[DEBUG] Deleting reg key $rsaKey";
reg delete "$rsaKey" /f;
} else {
Write-Host "[ERROR] Failed to find and delete RSA registry keys.";
}
} else {
Write-Host "[ERROR] Decryption binary failed with exit code $LASTEXITCODE";
}
} else {
Write-Host "[ERROR] Failed to find LockBit RSA registry key. Skipping decryption.";
}
# Remove remaining registry entries
if (reg.exe query "HKCR\.sk12uyqzk" 2>$null) {
Write-Host "[DEBUG] Deleting reg key HKCR\.sk12uyqzk";
reg delete HKCR\.sk12uyqzk /f;
} else {
Write-Host "[DEBUG] Reg key HKCR\.sk12uyqzk not found. Skipping";
}
if (reg.exe query "HKCR\sk12uyqzk\DefaultIcon" 2>$null) {
Write-Host "[DEBUG] Deleting reg key HKCR\sk12uyqzk\DefaultIcon";
reg delete HKCR\sk12uyqzk\DefaultIcon /f;
} else {
Write-Host "[DEBUG] Reg key HKCR\sk12uyqzk\DefaultIcon not found. Skipping";
}
# Delete files
Write-Host "[INFO] Deleting dropped files";
$artifacts = @(
"C:\ProgramData\83426913-9751-4a75-b159-65f7bf232961.exe" # main lockbit binary
"C:\Windows\83426913-9751-4a75-b159-65f7bf232961.exe" # main binary (via psexec)
"C:\windows\83426913-9751-4a75-b159-65f7bf232961.bat" # alternative step batch script (via psexec)
"C:\ProgramData\83426913-9751-4a75-b159-65f7bf232961.bat" # alternative step batch script
"C:\ProgramData\83426913-9751-4a75-b159-65f7bf232961.min.exe" # alternative step binary
"C:\Windows\Temp\min.exe" # alternative step binary (via propagation)
"C:\Users\Public\lockbit_decryptor.exe" # cleanup binary
"C:\Windows\Temp\381jwk.tmp" # self-deletion helper
"$env:ProgramData\sk12uyqzk.bmp" # wallpaper resource
"$env:ProgramData\sk12uyqzk.ico" # icon resource
);
$artifacts | %{
if (Test-Path "$_") {
Write-Host "[DEBUG] Deleting file $_";
Remove-Item -Force "$_";
} else {
Write-Host "[DEBUG] File $_ not found. Skipping";
}
};
}
}