lockbit | 230505-d3gfvaab5s_pw_infected[.]zip

General

Target

230505-d3gfvaab5s_pw_infected.zip
Size

97KB
MD5

e498463ed9670be0aab90dc557bd4d05
SHA1

f4b344bbe321de0bb0eb47d6d946ee87711e6217
SHA256

76311eb148f9b75cd8fac2bc49bc5f7cb0863e4ca28de1608364bcfc11e38e8f
SHA512

14da47d85bdbc833618fcbe49fa5ee7b800bf0549221727917a1de21fcc4473a17e9bf85a15bd5c931c2ed2a4f8f00c3ecc4985727033805a810aa1293a38520
SSDEEP

1536:jLt1DG4LzT2aK4/WQhvriRJQ5sge9BLkz/1/cPOGavbn8UgQL3GRQcqo/5LUcKtw:jpVh26/HvORJtkzuPm8UgQLNcd5nkvK

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack002/6fe8607c799901f812ac46bf98920005ba08c6f8b1c6850835b170baa0ff95e0.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/6fe8607c799901f812ac46bf98920005ba08c6f8b1c6850835b170baa0ff95e0.exe

Files

230505-d3gfvaab5s_pw_infected.zip
.zip

Password: infected
6fe8607c799901f812ac46bf98920005ba08c6f8b1c6850835b170baa0ff95e0.zip
.zip

Password: infected
6fe8607c799901f812ac46bf98920005ba08c6f8b1c6850835b170baa0ff95e0.exe
.exe windows x86

914685b69f2ac2ff61b6b0f1883a054d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetPixel
GetPixel
SelectPalette
SelectObject
GetTextColor
BitBlt
GetDeviceCaps
CreateSolidBrush
CreateFontW
CreateDIBitmap

user32

LoadMenuW
LoadImageW
CreateDialogParamW
CreateWindowExW
DefWindowProcW
GetDlgItem
IsDlgButtonChecked

kernel32

GetLastError
GetProcAddress
GetModuleHandleA
GetLocaleInfoW
FreeLibrary
GetFileAttributesW
GetCommandLineW
GetCommandLineA

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

914685b69f2ac2ff61b6b0f1883a054d

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

kernel32

Sections

.text Size: 95KB - Virtual size: 95KB

.itext Size: 1KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 40KB - Virtual size: 43KB

.pdata Size: 6KB - Virtual size: 5KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 95KB - Virtual size: 95KB

.itext
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 40KB - Virtual size: 43KB

.pdata
Size: 6KB - Virtual size: 5KB

.reloc
Size: 4KB - Virtual size: 3KB