lockbit | a2bc2785420b0c6f685d8692d813fbbc[.]bin

General

Target
a2bc2785420b0c6f685d8692d813fbbc.bin
Size 102KB
Sample240330-b423tsfa89
SHA256 07926e060b7083bbe639b36e9c79cce23404ba9dcaa58c190ee40d7d415ff96f
MD5 203cb9773c4d449beae2fcec79f2e54b
SHA1 73c9b4b5ca30d8f41822382f746f48d3a0160030
SHA512 28ca2823e001621ab4a2c0bfa5c72bad1a5d85acb9c04ed5a07eb04730ba15daf45f6b3f4d8a666315b29a7fdd368f3b9abd425657a57e6b62e83aa5646f5987
SSDEEP 1536:EXSuYQEIi1P4ITv7MW2olU4FAFnDCGuketjSDJUP4afyp1n0Q8KQYS6FB0up:J9QS1P4ITv7D2okFnDtuelUP4IGKEJL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/1f9944ccc4cb956c4eb81e76d51b3cb048b838f2f746e2017d4492abd5e9ed79.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1f9944ccc4cb956c4eb81e76d51b3cb048b838f2f746e2017d4492abd5e9ed79.exe

File Explorer

a2bc2785420b0c6f685d8692d813fbbc.bin

.zip 102KB
1f9944ccc4cb956c4eb81e76d51b3cb048b838f2f746e2017d4492abd5e9ed79.exe

.exe 162KB

a2bc2785420b0c6f685d8692d813fbbc.bin

SHA256 07926e060b7083bbe639b36e9c79cce23404ba9dcaa58c190ee40d7d415ff96f
MD5 203cb9773c4d449beae2fcec79f2e54b
SHA1 73c9b4b5ca30d8f41822382f746f48d3a0160030
SHA512 28ca2823e001621ab4a2c0bfa5c72bad1a5d85acb9c04ed5a07eb04730ba15daf45f6b3f4d8a666315b29a7fdd368f3b9abd425657a57e6b62e83aa5646f5987
SSDEEP 1536:EXSuYQEIi1P4ITv7MW2olU4FAFnDCGuketjSDJUP4afyp1n0Q8KQYS6FB0up:J9QS1P4ITv7D2okFnDtuelUP4IGKEJL
MD5 SHA1 SHA512 SSDEEP

Password

infected

1f9944ccc4cb956c4eb81e76d51b3cb048b838f2f746e2017d4492abd5e9ed79.exe

IMPHASH a50a0d82b9120fc73965c28fea79e1f9
SHA256 1f9944ccc4cb956c4eb81e76d51b3cb048b838f2f746e2017d4492abd5e9ed79
MD5 a2bc2785420b0c6f685d8692d813fbbc
SHA1 b118551289c9398a339cd1161b2c101571d4b5fd
SHA512 32deb1d43a25b1b184f5ac212099d3004277d609d2784297c96632abe181e8c95f62185ea23ecefe640153c454bbcb33ef879d6c2d543f186160c9765e8bf0f8
SSDEEP 3072:W5uyulsHwDV1gFnTwn7zwJGJ+at5kCI5Gzei3N2VzRmK:W5uZ1DPgFnk7EJwJI5gDN2VVm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

111741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

a2bc2785420b0c6f685d8692d813fbbc.bin

1f9944ccc4cb956c4eb81e76d51b3cb048b838f2f746e2017d4492abd5e9ed79.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

a2bc2785420b0c6f685d8692d813fbbc.bin

1f9944ccc4cb956c4eb81e76d51b3cb048b838f2f746e2017d4492abd5e9ed79.exe

gdi32

user32

kernel32

generic