Overview

overview

10

Static

static

10

Lockbit 3.0.rar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Lockbit 3.0.rar

  • Size

    3.2MB

  • MD5

    feb587492965e27725f12cebfe9c0f63

  • SHA1

    043fa82cd179a0c0d33d958534d0ac4a266af4fe

  • SHA256

    41a698eb7c58022975ddb16d80e444234a71b1a3dfb3e017ad80a6ac8c541063

  • SHA512

    5fc600d9a92dacf88f25dd9dc8882d2690ac814c1d785438e5fca6fd8b209b5da994545a70470b049c4f1bf0c4f235bacb4948e684df6617ad0764f9812a5ab1

  • SSDEEP

    49152:8qITzbEX3VLCIWxBR58XL0Ech+4YcU/4ni+XaoCsqDLH80rGUol7CUDIM7Ozc8Ov:Hkzbk+R5owfKV+X9CTv3aUoluUDrCcnx

Score
10/10
pdflinklockbitblackmatter

Malware Config

Extracted

Family

blackmatter

Version

25.239

Signatures

  • Blackmatter family
    blackmatter
  • Lockbit family
    lockbit
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

    pdflink
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Lockbit 3.0.rar
    .rar .zip polyglot
  • LockBit-main.zip
    .zip
  • LockBit-main/Build.bat
  • LockBit-main/README.md
    .vbs
  • LockBit-main/builder.exe
    .exe windows:5 windows x86 arch:x86

    d2e26e45dcb84f1062f90f29a9cf0faa


    Headers

    Imports

    Sections

  • LockBit-main/config.json
  • LockBit-main/keygen.exe
    .exe windows:5 windows x86 arch:x86

    73eeda700d0a0376845c61c44155f4a8


    Headers

    Imports

    Sections

  • Lockbit-Black-3.0-main.zip
    .zip
  • Lockbit-Black-3.0-main/LICENSE
  • Lockbit-Black-3.0-main/README.md
  • Lockbit-Black-3.0-main/Threat Spotlight Lockbit Black 3.0 Ransomware.pdf
    .pdf

    • https://twitter.com/vxunderground/status/1543661557883740161

    • https://twitter.com/WhichbufferArda/status/1543669679637553158

    • https://www.cisa.gov/uscert/ncas/alerts/AA19-168A

    • https://chuongdong.com/reverse%20engineering/2022/03/19/LockbitRansomware/

    • https://github.com/OALabs/hashdb

    • https://github.com/whichbuffer/Lockbit-Black-3.0/blob/main/HLJkNskOq.README.txt

    • https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    • https://attack.mitre.org/techniques/T1078/

    • https://attack.mitre.org/techniques/T1190/

    • Show all
  • Lockbit-Black-3.0-main/{04830965-76E6-6A9A-8EE1-6AF7499C1D08}.zip
    .zip