lockbit | lockbit_v3_unpacked[.]7z[.]zip

General

Target
lockbit_v3_unpacked.7z.zip
Size 92KB
Sample240311-gl8esadc69
SHA256 70c0f2d25b1d2eee2273fbd05ffa16e3cfe5880f9b2f66b66eed3029fd611a5b
MD5 17be8e651ee133803ffef9b32c69f511
SHA1 027328191d00f025cee3c1dec78530b880f879cc
SHA512 39e58fecd9ae968c8c3be867762f968806412461e51180821a898cf771374963b5d27ee830459e08c8e04f22f49082e95b68a2c099db49b227118db3549d061c
SSDEEP 1536:zYoBkcmbZMd8TQ0hx3GkBgki8A4y7oMymFQmh7C+5KceOOyHBR7MT0Ua3m:sIgo0hx3G5kLcLKAOy3FUa3m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack002/lockbit_v3_unpacked.mal_	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/lockbit_v3_unpacked.mal_

File Explorer

lockbit_v3_unpacked.7z.zip

.zip 92KB
lockbit_v3_unpacked.7z

.7z 92KB
lockbit_v3_unpacked.mal_

.exe 162KB

lockbit_v3_unpacked.7z.zip

SHA256 70c0f2d25b1d2eee2273fbd05ffa16e3cfe5880f9b2f66b66eed3029fd611a5b
MD5 17be8e651ee133803ffef9b32c69f511
SHA1 027328191d00f025cee3c1dec78530b880f879cc
SHA512 39e58fecd9ae968c8c3be867762f968806412461e51180821a898cf771374963b5d27ee830459e08c8e04f22f49082e95b68a2c099db49b227118db3549d061c
SSDEEP 1536:zYoBkcmbZMd8TQ0hx3GkBgki8A4y7oMymFQmh7C+5KceOOyHBR7MT0Ua3m:sIgo0hx3G5kLcLKAOy3FUa3m
MD5 SHA1 SHA512 SSDEEP

Password

infected

lockbit_v3_unpacked.mal_

IMPHASH a50a0d82b9120fc73965c28fea79e1f9
SHA256 d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee
MD5 628e4a77536859ffc2853005924db2ef
SHA1 c2a321b6078acfab582a195c3eaf3fe05e095ce0
SHA512 aae3e3e9b12ab7389e5f2eac89b2a306c4d2b91bb4204f83cc7308a83c3dea88bbc2d826546c886fd580c01245a6be5c0aefcd93936daeecb3614935248de5f1
SSDEEP 3072:o5uyulsHwDV1gFnTwn7zwJGJ+3t5kCI5Gzei3N2VzRmK:o5uZ1DPgFnk7EJwaI5gDN2VVm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

111727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

lockbit_v3_unpacked.7z.zip

lockbit_v3_unpacked.7z

lockbit_v3_unpacked.mal_

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

lockbit_v3_unpacked.7z.zip

lockbit_v3_unpacked.7z

lockbit_v3_unpacked.mal_

gdi32

user32

kernel32

generic