Overview

overview

10

Static

static

10

explorer.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    explorer.exe

  • Size

    160KB

  • MD5

    fdd9f9ae1d24dcc709cd0abcea638ed0

  • SHA1

    2fe29b620b51d2258373b12d926a91d0a3720a60

  • SHA256

    4134d5d8f7b038e23e7887db56bb3ad295341a1aaf0bebe6be21d901d06dd662

  • SHA512

    db995ac8fa51a49e3b9550b0bb4069bbef08a9157d942cffcae24cabb720be01e17afffc9bfb54e95d4883adc6af27c5cb78291d408d0137591eff690669c3ef

  • SSDEEP

    3072:5uJ9OlKolUa1U197bzhVsmftsoo4jE8AI8vOMvjEF0Q:5ufj0zi1dNVsmfttjY8LLej40Q

Score
10/10
lockbit

Malware Config

Signatures

  • BlackMatter API Hashing IAT pattern was detected 1 IoCs

    This rule detects samples from the BlackMatter family unpacked in memory, identifying code reuse of key functions.

  • Lockbit family
    lockbit
  • Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
  • This rule detects samples from the Lockbit3.0 (and BlackMatter) family unpacked in memory, identifying code reuse of key functions. 1 IoCs

    This rule detects samples from the Lockbit3.0 (and BlackMatter) family unpacked in memory, identifying code reuse of key functions.

  • This rule detects the code pattern of the Stack Strings decryption algorithm. 1 IoCs

    This rule detects the code pattern of the Stack Strings decryption algorithm.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • explorer.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    89b43582b27abefb2b74684ab12a2f8e


    Headers

    Imports

    Sections