lockbit | LBB_pass_exe[.]zip | Triage

Sharing

General

Target

LBB_pass_exe.zip
Size

154KB
MD5

71ff38bd901be3eb6286220ffb12fc9a
SHA1

4b48b3d555f12677d223bd6037b618643773b08f
SHA256

40406fd8c1d7e3c44dff7dfe669dd0a681e22aea3a4a31ba7df7e3a9c5e4be75
SHA512

3c18efc9e7dab6ad50b5a1cf2b5993a7cb98e2e10231869beece8abf5bac0e9a3e3c2d142f602fc95505cd80d5c7efbfc53408bbb0f0434689ea4ea3e572fe11
SSDEEP

3072:yeGwRF9bAvgQ3ho5ZGn1cL7Ko3/qwH/NcRqVgTI2xQ+IEaPIP+fE3:rdKgQ3ho5ZUcL7Ko3ywmI0QvpfE3

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/LBB_pass_exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/LBB_pass_exe

Files

LBB_pass_exe.zip
.zip

Password: infected
LBB_pass_exe
.exe windows x86

Password: infected

89b43582b27abefb2b74684ab12a2f8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

CreateDIBitmap
TextOutW
SetTextColor
SetPixel
GetTextMetricsW
GetTextColor
GetTextCharset
BitBlt

user32

CreateDialogParamW
CreateMenu
DefWindowProcW
EndDialog
GetDlgItem
GetKeyNameTextW
LoadImageW

kernel32

GetModuleHandleW
SetLastError
LoadLibraryW
LoadLibraryExA
FormatMessageW
GetLastError
GetDateFormatW
GetAtomNameW

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE