lockbit | 16188566171[.]zip

General

Target
16188566171.zip
Size 104KB
Sample240325-rdknvsdb6s
SHA256 0e3b4659b375953c20948e451fb0f25e99906238df1736a3d365285ea44a160a
MD5 d33c7934fe87209b3b2a916a1f212db9
SHA1 9da16be10d87a9ebbe35299ecbc4ff16715bbd33
SHA512 1704f1d881c07e1d667fa7dfd5ecb2b37cf32913a6268dd381473b017b72da33742f124b4bfa0bf1c4c3ab3e11c6181f2b6e3ec1360b7f24653cee5bc3833393
SSDEEP 3072:3jeRy5iTF3x4U1ixp9srOPeSeI210wop4PxvQP:3ixx4UQxp9MBfEp4Pt8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8

File Explorer

16188566171.zip

.zip 104KB
1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8

.exe 153KB

16188566171.zip

SHA256 0e3b4659b375953c20948e451fb0f25e99906238df1736a3d365285ea44a160a
MD5 d33c7934fe87209b3b2a916a1f212db9
SHA1 9da16be10d87a9ebbe35299ecbc4ff16715bbd33
SHA512 1704f1d881c07e1d667fa7dfd5ecb2b37cf32913a6268dd381473b017b72da33742f124b4bfa0bf1c4c3ab3e11c6181f2b6e3ec1360b7f24653cee5bc3833393
SSDEEP 3072:3jeRy5iTF3x4U1ixp9srOPeSeI210wop4PxvQP:3ixx4UQxp9MBfEp4Pt8
MD5 SHA1 SHA512 SSDEEP

Password

infected

1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8

IMPHASH 914685b69f2ac2ff61b6b0f1883a054d
SHA256 1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8
MD5 fc574bb43fdd40afb914909e27b0c02b
SHA1 b7ad2ef359b343e73f0399a2bd9b15fe9e7b58f2
SHA512 16cfcd67e871773a9073f32050e3f7da749284d6218027b405f0f9bdfb8d7e2f1ffb644825cf00a5e3da00aab54a301e23c30569c8e1259f315ea1221b565154
SSDEEP 3072:FqJogYkcSNm9V7DEA72bjSwMZNdmhCySRYT:Fq2kc4m9tDYbjLMZN4hC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

16188566171.zip

1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

16188566171.zip

1f2d57fd92961d57a1a7b09c7bbddfdc95b2246f1f6874d6aa52aedd77d5cfa8

gdi32

user32

kernel32

generic