# LockBit Ransomware v4.0 (LockBitGreen4.0-rc-577) Reverse Engineering Analysis

> Reverse engineering of the LockBit 4.0 ('Green') Windows encryptor, build LockBitGreen4.0-rc-577, shows API-hash resolution, ETW patching of EtwEventWrite, a Russian keyboard-layout kill switch, and Curve25519 + XChaCha20 per-file encryption that drops Restore-My-Files.txt. The code overlaps with Conti, and the RaaS operation behind it is the Russian-speaking LockBit group (GOLD MYSTIC).

- **Published:** 2026-11-04T22:39:36Z
- **Last reviewed:** 2026-11-04T22:39:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5278
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5278.png
- **ID:** TL-2026-5278
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** LockBit (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

LockBit 4.0 was announced in December 2024 in both Green and Black versions and released in February 2025 by the LockBit ransomware-as-a-service operation. This analysis, published by Chuong Dong on 2025-03-15, covers the Windows encryptor build string 'LockBitGreen4.0-rc-577' (MD5 c40abd19c60371e1daf19346d88d2881, SHA256 4f76df691e2ea292b56812eb3167efcab655382d632048ff63781f5d41f86433). A packed sample has SHA256 67ac04c1b7526288194e53da33cc0e9661687fd4fbbf12156e5ef6dd2a4108eb. Sophos records that LockBit Green was launched in early 2023 using defunct Conti code, and the analysis notes the shadow-copy deletion is 'basically the same as that in Conti'.

Evasion and anti-analysis: Windows APIs are resolved through a custom hashing routine (initial value 0x14BD, case normalization, XOR and position-dependent multiplication), with multi-layer XOR-obfuscated strings. EtwEventWrite() is neutralized by building a 'ret 0x14' patch and writing it over the function entry with ZwProtectVirtualMemory() and ZwWriteProcessMemory(). The sample calls GetKeyboardLayoutList() and aborts if a Russian layout (0x419) is present, printing 'Найдена русская раскладка клавиатуры'. The '-nomutex' argument is accepted but has no effect.

Pre-encryption impact: A hashed allowlist of 120+ process names protects critical processes, and other processes (including file owners) are terminated with ZwTerminateProcess() after an NtQueryInformationProcess() check. 47 hashed service names are stopped with ControlService() and disabled with ChangeServiceConfigA(SERVICE_DISABLED). Volume shadow copies are deleted using Conti-style logic. Every Windows event log channel is enumerated (EvtOpenSession, EvtOpenChannelEnum, EvtNextChannelPath) and cleared with EvtClearLog().

Encryption: Each file gets a Curve25519 key pair, and the shared secret protects an XChaCha20 file key (SHA512 is used in key derivation). Encrypted files get a 0x5C-byte footer containing the marker 'FBIsosite', the encrypted file key, a custom keys hash and the per-file Curve25519 public key. The embedded LockBit public key is f972c17213f928a011870a5ae5b6492e41170c93d2fa61e816a13f9dbf090b02. Files over 1 MB (0x100000) are partially encrypted as three chunks of about 9% each, and smaller files are fully encrypted. The original extension is replaced by a string derived from 'lb4' with a custom XOR routine. Files with exe, lnk, dll, cpl or sys extensions are skipped, as are Restore-My-Files.txt, iconcache.db and thumbs.db, and files under 17 bytes. The RC4-encrypted ransom note Restore-My-Files.txt (RC4 key 0753d87845c8468a6a712586955ff9ba) states 'You have been attacked by LockBit 4.0 - the fastest, most stable and immortal ransomware since 2019'. It carries the access key ADTISZRLVUMXDJ34RCBZFNO6BNKLEYKYS5FZPNNXK4S2RSHOENUA and lists LockBit onion blog, payment, chat and recruitment addresses. Command-line options are -m local|net|all, -p <path>, -f (force, bypass folder restrictions), -k (keep .exe), -q (quiet: no extension change, timestamps preserved, no note) and -h. After running, the binary renames itself to a random 6-character name via NtSetInformationFile(FileRenameInformation) and marks itself for deletion with FileDispositionInformation.

Affiliate tradecraft documented by Sophos for LockBit operations: initial access via Citrix Bleed and Fortigate firewall exploitation, credential harvesting with Mimikatz and LaZagne, reconnaissance with SoftPerfect Network Scanner, Advanced Port Scanner and ADFind, Cobalt Strike post-exploitation, RDP and PsExec lateral movement, and StealBit for exfiltration. These come from the Sophos profile of LockBit operations in general, not from the analysed sample. The group was disrupted by Operation Cronos (2024-02-19) but resumed operations. Check Point reported in October 2025 that LockBit 5.0 (codename 'ChuongDong') had hit about a dozen victims in September 2025. Active exploitation of this specific build is not stated in the primary source, so the status reflects the ongoing ransomware family.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1106 Native API
- T1569.002 Service Execution
- T1027 Obfuscated Files or Information
- T1027.007 Dynamic API Resolution
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1070.004 Indicator Removal: File Deletion
- T1003 OS Credential Dumping
- T1614.001 System Location Discovery: System Language Discovery
- T1057 Process Discovery
- T1135 Network Share Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1489 Service Stop
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**LockBit 4.0 Ransom Note Restore-My-Files.txt Mass Creation — Encryption Impact** (`TL-2026-5278-SPL-001`)

Detects the LockBit 4.0 (LockBitGreen4.0-rc-577) encryptor dropping its ransom note Restore-My-Files.txt into multiple directories within a short window (T1486). The encryptor writes one note per encrypted directory, so three or more distinct note paths from one host in ten minutes is a high-fidelity ransomware execution signal. The search also counts the distinct volume prefixes (drive letters or UNC) receiving notes, since -m all and -m net make the encryptor traverse directories (T1083) across local volumes and network shares (T1135). Note: the -q (quiet) switch suppresses the note, so pair this with the encryptor hash/CLI and shadow-copy detections.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1486, T1083, T1135
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
```LockBit 4.0 (LockBitGreen4.0-rc-577) drops Restore-My-Files.txt in every encrypted directory; alert on 3+ distinct note paths per host in 10 minutes``` index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 TargetFilename="*Restore-My-Files.txt" earliest=-24h | eval volume=substr(TargetFilename,1,2) | bin _time span=10m | stats dc(TargetFilename) as ransom_notes_written dc(volume) as volumes_touched values(volume) as volumes min(_time) as first_seen max(_time) as last_seen values(Image) as writer_process values(User) as user by host _time | where ransom_notes_written>=3 | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table host user writer_process ransom_notes_written volumes_touched volumes first_seen last_seen
````

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated" and FileName =~ "Restore-My-Files.txt"
| summarize NotesWritten=dcount(FolderPath), VolumesTouched=dcount(substring(FolderPath, 0, 2)), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256, InitiatingProcessAccountName, Window=bin(Timestamp, 10m)
| where NotesWritten >= 3
| project Window, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessSHA256, NotesWritten, VolumesTouched, FirstSeen, LastSeen
```

### Sigma

```yaml
title: LockBit 4.0 Ransom Note Restore-My-Files.txt Created
id: 3e8b1f6a-72c4-4a9d-b5e0-0f1c9a4d7e11
status: experimental
description: Detects creation of the LockBit 4.0 (LockBitGreen4.0-rc-577) ransom note Restore-My-Files.txt, dropped into encrypted directories.
references:
    - https://www.chuongdong.com/reverse%20engineering/2025/03/15/Lockbit4Ransomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.impact
    - attack.t1486
    - attack.discovery
    - attack.t1083
    - attack.t1135
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\Restore-My-Files.txt'
    condition: selection
falsepositives:
    - Backup or restore tooling that legitimately creates a file with the same name (unlikely)
level: critical
```

**Known false positives:**

- Incident-response or red-team exercises that replay LockBit ransom-note artifacts in a lab
- Security tooling or sandboxes that detonate samples and generate the note on analysis hosts

**Tuning notes:** Exclude known malware-analysis sandboxes by host. The threshold of 3 distinct note paths per 10 minutes can be lowered to 2 in high-value server tiers. Sysmon EventCode 11 must be enabled for the file-create rule. The -q switch suppresses the note, so do not rely on this rule alone. Alert on volumes_touched>=2 (or a UNC prefix) to raise priority for -m all / -m net runs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- LockBit 4.0 Encryptor Execution by Hash and Command-Line Switches (locked: unlock with TL Creds)
- Burst of Services Set to Disabled — LockBit Pre-Encryption Service Stop (locked: unlock with TL Creds)
- RDP Lateral Movement Fan-Out from a Single Source — LockBit Affiliate Spread (locked: unlock with TL Creds)
- Volume Shadow Copy and Recovery Inhibition Commands (Conti-Style, LockBit 4.0) (locked: unlock with TL Creds)
- Windows Event Log Cleared — LockBit 4.0 EvtClearLog Anti-Forensics (locked: unlock with TL Creds)
- PsExec and Cobalt Strike Remote Service Installation (Lateral Movement) (locked: unlock with TL Creds)
- LockBit Affiliate Credential Theft and Recon Tooling (Mimikatz, LaZagne, AdFind, Network Scanners) (locked: unlock with TL Creds)
- LockBit Tor Onion Access and Community-Observed Cobalt Strike C2 Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- Domain: `lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id[.]onion`
- File hash: `c40abd19c60371e1daf19346d88d2881`
- Domain: `lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id[.]onion`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [LockBit Ransomware v4.0 - Chuong Dong](https://www.chuongdong.com/reverse%20engineering/2025/03/15/Lockbit4Ransomware/)
- [Sophos CTU Threat Profile: GOLD MYSTIC](https://www.sophos.com/en-us/threat-profiles/gold-mystic)
- [Check Point Research: LockBit Returns and It Already Has Victims](https://blog.checkpoint.com/research/lockbit-returns-and-it-already-has-victims/)
- [Intel 471 Emerging Threat: LockBit 4.0 (March 2025)](https://go.intel471.com/hubfs/Emerging%20Threats/Emerging%20Threat%20-%20LockBit%204.0%20-%20March%202025.pdf)
- [Joint Technical Advisory on LockBit 3.0 and 4.0 (2 May 2025)](https://isomer-user-content.by.gov.sg/36/1f56c162-080e-4e49-a005-abf1fd9bd0e4/Joint%20Technical%20Advisory%20on%20LockBit%203.0%20and%204.0%20(2%20May%202025).pdf)
- [SOCRadar: Technical Analysis of LockBit 4.0 - Evasion Tales](https://socradar.io/free-tools/ioc-radar/reports/technical-analysis-of-lockbit4-0-evasion-tales-5c4a248453b8)
- [LockBit - Wikipedia](https://en.wikipedia.org/wiki/LockBit)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5278