Resubmissions
03/05/2023, 06:56
230503-hqll9adh35 1002/05/2023, 10:00
230502-l1wfzsae76 1028/01/2023, 20:32
230128-zbct8sgc59 1028/01/2023, 20:31
230128-za2rzahf8x 323/01/2023, 21:24
230123-z9hhdafe87 1023/01/2023, 21:19
230123-z6jw2afe75 1023/01/2023, 21:08
230123-zy4apsfe37 1023/01/2023, 20:56
230123-zrhenafd86 1023/01/2023, 16:41
230123-t7eqtafg6t 1023/01/2023, 16:29
230123-tzremseb62 10General
-
Target
lawsuit.zip
-
Size
8.5MB
-
Sample
230123-twbj1sfg2v
-
MD5
01ccead2e9497ce04ab0c2531320224d
-
SHA1
9b7ebc4d8f97b0e7463a382f3b748a4be48a06a1
-
SHA256
c898a07ac3e02231a48bf55bd8828d4c77c7ea3c5cfe80e9eec44c81cb476cbb
-
SHA512
25a07ce5f211dfef00939eb61084675991b72d859ddd39db0d1e5af591811675cec30cc9a6ce397ad2d2abbcc60faff02e556bf8ff6c86045b8d23e6843c04cb
-
SSDEEP
98304:w9D8TiRYDS2JAVvOhwGw7Kn7iL/ji7BmdAMdT+a3bRQXR5s6PX2STjwmZ0nZSmAL:M+K2JgmwwOL7cLy+aW5puAjgtp5YVr
Behavioral task
behavioral1
Sample
lawsuit/cohen_allme.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
lawsuit/cohen_allme.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
lawsuit/disclaimer_.jpg
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
lawsuit/disclaimer_.jpg
Resource
win10v2004-20221111-en
Malware Config
Extracted
C:\wKTiyscK2.README.txt
14hsKjR7L2KNmPpzeoXtNB8C2AuBL5Ch88
Targets
-
-
Target
lawsuit/cohen_allme.exe
-
Size
6.6MB
-
MD5
85c334bcbc345885521e123ebd3772d1
-
SHA1
59f5c305e1953b724a58522ee727f024c74005da
-
SHA256
0149fd43bdf3d18369d8993505dd719631eec255eab97a0ad1dbc28ed38d5a54
-
SHA512
aea3f467c4a450de44e4c2355c30f2de11a98d77fcad465675eec0fcba35709ef23b5df9f0cbc06363c43009384d8a529567cd05c43d94fc3385f53bb95c517a
-
SSDEEP
196608:LuoqdQmRrdA6lsuErSEEJwdF65tYPXki:S9dQOls+9J5t6
Score10/10-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
-
-
Target
lawsuit/disclaimer_.jpg
-
Size
4.4MB
-
MD5
b5fcc0c469b26f237a98ff942c36d16a
-
SHA1
10069dd89fec1caeb0e789b78cdd7da08718ddd6
-
SHA256
5ac97df082e0ab86e429c128ce033bd1bf1a23274cf156ab2063dcbb9c582229
-
SHA512
fc5fc46fcd5cf9d33ba1b65bcebc3a63d2782c3ed5821c844f8e7b6dd085352f6a48c69ba6705ae542712084cc9b60f18c20680c66e5944aece094b70e9b0d0f
-
SSDEEP
49152:vQkQOzbBX1WtLOHeJAJmIY74HpGlTmnpzWbYhXNotM+uzwALWorx1+:v3W1OKAmF4MdmAYhoMyorx1+
Score3/10 -