lockbit | Lockbit4[.]zip

General

Target
Lockbit4.zip
Size 93KB
Sample240328-qswt1afc61
SHA256 e4bd46ed9c588b369dc6cbaa9d8dd61d59424b677e4724aa7bbe4dc83b170f92
MD5 cbfa130416e1cd2a0ddf457e635d9c3d
SHA1 e16a5d32dea354085cd845f9ab8b3d778f890cb4
SHA512 80f9e8c3934a37941387ecbf79c130a5cfbd8169606bc6f9f35e143e9d4309dc06fd4383c20ed96c9d988246ba347beb11e3707f109674cc07ba86a392fcc735
SSDEEP 1536:QURyj38t1eValnHfpPEiNZh+hBtk/yJFhR+N+Z7+/ZyNkR7jk/8bXEAoVlLNNS:hY38t1GSfpEKGIyThRJ7jeF48b0NVlLm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/Lockbit4.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Lockbit4.exe

File Explorer

Lockbit4.zip

.zip 93KB
Lockbit4.exe

.exe 146KB

Lockbit4.zip

SHA256 e4bd46ed9c588b369dc6cbaa9d8dd61d59424b677e4724aa7bbe4dc83b170f92
MD5 cbfa130416e1cd2a0ddf457e635d9c3d
SHA1 e16a5d32dea354085cd845f9ab8b3d778f890cb4
SHA512 80f9e8c3934a37941387ecbf79c130a5cfbd8169606bc6f9f35e143e9d4309dc06fd4383c20ed96c9d988246ba347beb11e3707f109674cc07ba86a392fcc735
SSDEEP 1536:QURyj38t1eValnHfpPEiNZh+hBtk/yJFhR+N+Z7+/ZyNkR7jk/8bXEAoVlLNNS:hY38t1GSfpEKGIyThRJ7jeF48b0NVlLm
MD5 SHA1 SHA512 SSDEEP

Lockbit4.exe

IMPHASH 914685b69f2ac2ff61b6b0f1883a054d
SHA256 9b5f1ec1ca04344582d1eca400b4a21dfff89bc650aba4715edd7efb089d8141
MD5 e544b3593a6441f9654839e11aa0bea5
SHA1 f7d5e39e1b031002887b4a7d8a8ef889c892c3e7
SHA512 9c6f2a04307b0a41e9aaf7c9c68dd901787d7ad65e80f293893c21e026e2de11b729b0fdbeb0c0926214e85d9b4c3473e94017be2e0fb49ed5a91fdff7ca9e83
SSDEEP 1536:KzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xD3pt0uCM0Ej+/dO9fRQvffQBfFT:5qJogYkcSNm9V7D5NuEBfWf4BfFT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Lockbit4.zip

Lockbit4.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

Lockbit4.zip

Lockbit4.exe

gdi32

user32

kernel32

generic