General
-
Target
LB3.exe
-
Size
145KB
-
Sample
230326-ee3jvahd4t
-
MD5
922dea2c04ec79d24a7ecc3edb6b36c7
-
SHA1
7b829bb5a8f4e4e503c16864330c17cb7996ee2b
-
SHA256
99d3003cc577c3635bcbb883634037469b35c3b1a31109dc145600bb1e683d4b
-
SHA512
165d7d50323bf441249c1046ac9cf9fd77700fd977fc682567b4b265c44254587f4a9d000ae87850e6db56f063bd541139554536ee3659586856e99ebd5e6bc2
-
SSDEEP
1536:HzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEpOFNPslzvMYFzdT1cg6bjtx0V:4qJogYkcSNm9V7DWOXezUMzdTixD3kT
Behavioral task
behavioral1
Sample
LB3.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
LB3.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
LB3.exe
-
Size
145KB
-
MD5
922dea2c04ec79d24a7ecc3edb6b36c7
-
SHA1
7b829bb5a8f4e4e503c16864330c17cb7996ee2b
-
SHA256
99d3003cc577c3635bcbb883634037469b35c3b1a31109dc145600bb1e683d4b
-
SHA512
165d7d50323bf441249c1046ac9cf9fd77700fd977fc682567b4b265c44254587f4a9d000ae87850e6db56f063bd541139554536ee3659586856e99ebd5e6bc2
-
SSDEEP
1536:HzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEpOFNPslzvMYFzdT1cg6bjtx0V:4qJogYkcSNm9V7DWOXezUMzdTixD3kT
Score8/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-