Lockbit5 — Technical Analysis

This report provides a full technical analysis of a LockBit 5.0 hardened x64 ransomware sample (SHA-256 6d0166d1...), documenting a multi-layered MBA + PRNG obfuscation loader, per-string runtime decryption, an unpacked payload implementing X25519 key agreement, ChaCha20-20 file encryption with Keccak/SHAKE256 KDF, chunked encryption with per-chunk salts, and operational behaviours including SMB-based lateral movement, RunPE process hollowing, ETW patching, VSS shadow-copy deletion, geo/language exclusion, and a runtime-assembled ransom note with onion leak sites; the report includes recovered configuration artifacts, YARA rules, and indicators of compromise for detection and response.