lockbit | 877eb37ea80f10570de05fb3b9b4b290[.]bin

General

Target
877eb37ea80f10570de05fb3b9b4b290.bin
Size 27.5MB
Sample240309-bjscwsba59
SHA256 2bad639d0a1f90525ad56b31641b3bd5fe1310079d1e6abd6bc7889cdc1ff3f5
MD5 877eb37ea80f10570de05fb3b9b4b290
SHA1 85559ff8c2a3a346e2da1d53051f213469cb386c
SHA512 f2e224d03cf210f228f9ae2f4597653bf82a001a4650b0645c64adfe9df829b9691c1bd393cdecb90bfb681c002138dd098cff0cede1bb0805f625ba9e78407e
SSDEEP 786432:MSmSdoK5sxdV0OrywXGvgW2OHDjRom/pEdiN:bmoVGxdV0O7It2OjjRHxck
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/VoiceMod-Full-Version-Setup/Voicemod_setup.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/VoiceMod-Full-Version-Setup/Voicemod_setup.exe

File Explorer

877eb37ea80f10570de05fb3b9b4b290.bin

.zip 27.5MB
VoiceMod-Full-Version-Setup/Voicemod_setup.exe

.exe 146KB

877eb37ea80f10570de05fb3b9b4b290.bin

SHA256 2bad639d0a1f90525ad56b31641b3bd5fe1310079d1e6abd6bc7889cdc1ff3f5
MD5 877eb37ea80f10570de05fb3b9b4b290
SHA1 85559ff8c2a3a346e2da1d53051f213469cb386c
SHA512 f2e224d03cf210f228f9ae2f4597653bf82a001a4650b0645c64adfe9df829b9691c1bd393cdecb90bfb681c002138dd098cff0cede1bb0805f625ba9e78407e
SSDEEP 786432:MSmSdoK5sxdV0OrywXGvgW2OHDjRom/pEdiN:bmoVGxdV0O7It2OjjRHxck
MD5 SHA1 SHA512 SSDEEP

VoiceMod-Full-Version-Setup/Voicemod_setup.exe

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 e3300e30997c5a355f02ca6972711b2ca843d00a393b62c75818a43c27ff128d
MD5 3d49478072bf18339ef810c8ea7546b2
SHA1 c1047d72d4cdce21af4bb989ad1bee437edb7f80
SHA512 f47f6a1c51b92cc34a1dc264bc2b151690f1c314c5f97b08530e9efd6929c860985f9410f411cb31e0f3acd75b8969e4791ca9fb080901f6f4cb70322255a91c
SSDEEP 3072:A6glyuxE4GsUPnliByocWepU0DxwbL2LUnPaZw:A6gDBGpvEByocWeTDxOL2LScw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

877eb37ea80f10570de05fb3b9b4b290.bin

VoiceMod-Full-Version-Setup/Voicemod_setup.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

877eb37ea80f10570de05fb3b9b4b290.bin

VoiceMod-Full-Version-Setup/Voicemod_setup.exe

gdi32

user32

kernel32

generic