Behavioral task
behavioral1
Sample
2024-04-04_a5f44281ef9d3b525659691eb44e6ab9_darkside_lockbit.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-04_a5f44281ef9d3b525659691eb44e6ab9_darkside_lockbit.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-04_a5f44281ef9d3b525659691eb44e6ab9_darkside_lockbit
-
Size
176KB
-
MD5
a5f44281ef9d3b525659691eb44e6ab9
-
SHA1
6139f60888559fcea2ed8d9412eb6fb53d2e8ae8
-
SHA256
469604b689856c87463cad6d8df0e9f0da388d4046562b7979ded9f2f4a7b0cb
-
SHA512
10cd49458064fbde8087b55216507778178a4721c1ec0cfe5e2e457f09e6fca5897e9c6c44fe3926637538e64373d25a6317ee5a258a8bb99735790379f11623
-
SSDEEP
3072:W5uyulsHwDV1gFnTwn7zwJGJ+at5kCI5Gzei3N2VzRmK:W5uZ1DPgFnk7EJwJI5gDN2VVm
Malware Config
Signatures
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule sample family_lockbit -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-04_a5f44281ef9d3b525659691eb44e6ab9_darkside_lockbit
Files
-
2024-04-04_a5f44281ef9d3b525659691eb44e6ab9_darkside_lockbit.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 102KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.itext Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 40KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE