Overview

overview

10

Static

static

10

Build.bat

windows7-x64

1

Build.bat

windows10-2004-x64

1

Build/LB3.exe

windows7-x64

10

Build/LB3.exe

windows10-2004-x64

10

Build/LB3D...or.exe

windows7-x64

5

Build/LB3D...or.exe

windows10-2004-x64

5

Build/LB3_...in.dll

windows7-x64

10

Build/LB3_...in.dll

windows10-2004-x64

7

Build/LB3_...32.dll

windows7-x64

1

Build/LB3_...32.dll

windows10-2004-x64

1

Build/LB3_...ss.dll

windows7-x64

10

Build/LB3_...ss.dll

windows10-2004-x64

10

Build/LB3_pass.exe

windows7-x64

10

Build/LB3_pass.exe

windows10-2004-x64

10

builder.exe

windows7-x64

1

builder.exe

windows10-2004-x64

1

keygen.exe

windows7-x64

1

keygen.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7863e4bbb47ce09dc7fb0616d11abeb6.bin

  • Size

    886KB

  • MD5

    7863e4bbb47ce09dc7fb0616d11abeb6

  • SHA1

    f709bf15fc59f01023920356ec2edae2d29b5be1

  • SHA256

    b094665ec4cdca6d8e9b9f63d8d71b1b9263eda12f1fdd1d8aa820dbf4c231f6

  • SHA512

    222464fbbdbf6e02e7f72b84d305f11041c7513d63e085870bb528a43d6c647546f50bf4cfc3f498c2808910ce9d8bacc89d3a466c3576ee8aebc6aeee13b024

  • SSDEEP

    12288:zwIQcvpnYgqqkl+138+2S7caa6Fo9qfkwSqKH0XPkNBIVDhyT40/k+9qkRkmFFbX:xRnUl2LtHFoLc5XPkN+VQQkR9Jb8cA7q

Score
10/10
lockbitblackmatter

Malware Config

Extracted

Family

blackmatter

Version

65.239

Signatures

  • Blackmatter family
    blackmatter
  • Lockbit family
    lockbit
  • Rule to detect Lockbit 3.0 ransomware Windows payload 4 IoCs
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • 7863e4bbb47ce09dc7fb0616d11abeb6.bin
    .zip

    Password: infected

  • Build.bat
  • Build/DECRYPTION_ID.txt
  • Build/LB3.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    41fb8cb2943df6de998b35a9d28668e8


    Headers

    Imports

    Sections

  • Build/LB3Decryptor.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    4585cfc85e0cd554d6b5d4bf1bb3d5e4


    Headers

    Imports

    Sections

  • Build/LB3_ReflectiveDll_DllMain.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    b1826e7d9522633dc1f4953f25424ce3


    Headers

    Imports

    Sections

  • Build/LB3_Rundll32.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    b750c147c0bcc8b349e4f1143ac1432e


    Headers

    Imports

    Exports

    Sections

  • Build/LB3_Rundll32_pass.dll
    .dll windows:5 windows x86 arch:x86

    Password: infected

    b750c147c0bcc8b349e4f1143ac1432e


    Headers

    Imports

    Exports

    Sections

  • Build/LB3_pass.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    41fb8cb2943df6de998b35a9d28668e8


    Headers

    Imports

    Sections

  • Build/Password_dll.txt
  • Build/Password_exe.txt
  • Build/priv.key
  • Build/pub.key
  • builder.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    d2e26e45dcb84f1062f90f29a9cf0faa


    Headers

    Imports

    Sections

  • config.json
  • keygen.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    73eeda700d0a0376845c61c44155f4a8


    Headers

    Imports

    Sections