lockbit | 16523976580[.]zip

General

Target
16523976580.zip
Size 96KB
Sample240405-m38d1aaa9w
SHA256 1619d1ebff7dbbd6ca16ffea7885820c11b1c389c48bfefd2ba1b67d0049b154
MD5 9d4365959ff3fe2b41b8a19b64a1bc78
SHA1 8a45b7e25eeef7a3de4154a2ab52a5920026c8b9
SHA512 47d9333f4d1070a01cff09d761daf8870486f1be0a1a42fb5959062978c7a9b7c6b66bc5a887c9eae3708ac159e43b7acf1daf5704aa57e1c8e33cda0ec6381f
SSDEEP 3072:/2Hp5fiaMpkB2u5WiMVr+g1pcKSJwVW1eS:/2TAkAity1XceS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46

File Explorer

16523976580.zip

.zip 96KB
2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46

.exe 145KB

16523976580.zip

SHA256 1619d1ebff7dbbd6ca16ffea7885820c11b1c389c48bfefd2ba1b67d0049b154
MD5 9d4365959ff3fe2b41b8a19b64a1bc78
SHA1 8a45b7e25eeef7a3de4154a2ab52a5920026c8b9
SHA512 47d9333f4d1070a01cff09d761daf8870486f1be0a1a42fb5959062978c7a9b7c6b66bc5a887c9eae3708ac159e43b7acf1daf5704aa57e1c8e33cda0ec6381f
SSDEEP 3072:/2Hp5fiaMpkB2u5WiMVr+g1pcKSJwVW1eS:/2TAkAity1XceS
MD5 SHA1 SHA512 SSDEEP

Password

infected

2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46
MD5 4e39dcfb9913e475f04927e71f38733a
SHA1 5618cdd20144cf44ac0719bf917aac2ff882e41c
SHA512 678581a15c404351c98bacb0b2aa432023e9335536fefda4fe6613d2ba7daada5fa7fbc52b37c9b1c4421c7b66be44f1a5162d45478671018f8120ebbfa483e0
SSDEEP 3072:p6glyuxE4GsUPnliByocWepO+cDevjAEyYFEf:p6gDBGpvEByocWe0+oeENY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

16523976580.zip

2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

16523976580.zip

2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46

gdi32

user32

kernel32

generic