lockbit | LBB - DO NOT RUN[.]zip[.]zip

General

Target
LBB - DO NOT RUN.zip.zip
Size 95KB
Sample240306-jah2vsfd59
SHA256 c6b4ecf15f5cde3f09bc3b9c40360abc8016a6a1c623dbf378c33791c387449e
MD5 06c88d6bb7ff6ed07dfaf24a6e389b60
SHA1 c33d3c5b926dbc24a34707b78845ca1d20daee05
SHA512 992b7202a26915a096333918e2c64f7d746d64dc002b33bd0a7d2615e245e07c95291dec3d73a9a96dc851409e32b149db99cde5e710b2a8445b3473e2cc9d28
SSDEEP 1536:1YMEsKeNxj78j1ahmFpdSY2lrYdnkdUY3KHbqpN/jYZYVq54ayS4WxCR4TAIrk0/:SM7NxP8DdSPcdnk93KuDiYVq5+mQUAfy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack002/LBB.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/LBB.exe

File Explorer

LBB - DO NOT RUN.zip.zip

.zip 95KB
LBB - DO NOT RUN.zip

.zip 95KB
LBB.exe

.exe 156KB

LBB - DO NOT RUN.zip.zip

SHA256 c6b4ecf15f5cde3f09bc3b9c40360abc8016a6a1c623dbf378c33791c387449e
MD5 06c88d6bb7ff6ed07dfaf24a6e389b60
SHA1 c33d3c5b926dbc24a34707b78845ca1d20daee05
SHA512 992b7202a26915a096333918e2c64f7d746d64dc002b33bd0a7d2615e245e07c95291dec3d73a9a96dc851409e32b149db99cde5e710b2a8445b3473e2cc9d28
SSDEEP 1536:1YMEsKeNxj78j1ahmFpdSY2lrYdnkdUY3KHbqpN/jYZYVq54ayS4WxCR4TAIrk0/:SM7NxP8DdSPcdnk93KuDiYVq5+mQUAfy
MD5 SHA1 SHA512 SSDEEP

Password

infected

LBB.exe

IMPHASH 3bc510de773c954bd69d33670cb624d6
SHA256 0b8e80e7a32ac18e126df4630532b918b8f8a07cfc892848030b022ee15e1f57
MD5 a077928205e3577d2b32b9a305e182f5
SHA1 513da75a0620e3f1dc1d213bd951071fbd3fc068
SHA512 bcfb792865a11aaf81db4c01093efcee2e8cebc0f87eba05907c306bd6d56350c40730617ee3f97aad0dc2c12531b1018bdf0e36b96abb887bdd06d520d07043
SSDEEP 3072:hDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368UImRB8n72eg75AtWOOOqtW:r5d/zugZqll3/mR+n0Ate
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

111727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

LBB - DO NOT RUN.zip.zip

LBB - DO NOT RUN.zip

LBB.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

LBB - DO NOT RUN.zip.zip

LBB - DO NOT RUN.zip

LBB.exe

gdi32

user32

kernel32

generic