lockbit | 3[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
3.7z
Size 139KB
Sample240415-brz3psdf6s
SHA256 b2c3beda4b000a3d9af0a457d6d942ec81696f3ed485f7cf723b18008a5f3d10
MD5 c9c2f3805f0012628e9d62e8f75af4dd
SHA1 b6269b1fc8813b93c11ec6066dc33d9f99f2e431
SHA512 ed4cb425807bbef4da92fe9e17b78746e096612e6006521279162379b2fc65f8dec7647e9c5403c6a74e6eb9b61dce7ca1c74c65d77aafbd0719be79cb1d70ff
SSDEEP 3072:pYWJsCuSlRODbWhyyZZsZ77n4s31uZzd2ppyMPOLOcrgCz:pbuSlicZyx4W1uLYpyMPOLjhz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit blackmatter

Malware Config

Extracted

Family

blackmatter

Version

65.239

Signatures

Blackmatter family
blackmatter
Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/LBLeak/builder.exe	family_lockbit

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/LBLeak/builder.exe
unpack001/LBLeak/keygen.exe

File Explorer

3.7z

.7z 139KB
LBLeak/Build.bat

741B
LBLeak/builder.exe

.exe 470KB
LBLeak/config.json

8KB
LBLeak/keygen.exe

.exe 31KB

3.7z

SHA256 b2c3beda4b000a3d9af0a457d6d942ec81696f3ed485f7cf723b18008a5f3d10
MD5 c9c2f3805f0012628e9d62e8f75af4dd
SHA1 b6269b1fc8813b93c11ec6066dc33d9f99f2e431
SHA512 ed4cb425807bbef4da92fe9e17b78746e096612e6006521279162379b2fc65f8dec7647e9c5403c6a74e6eb9b61dce7ca1c74c65d77aafbd0719be79cb1d70ff
SSDEEP 3072:pYWJsCuSlRODbWhyyZZsZ77n4s31uZzd2ppyMPOLOcrgCz:pbuSlicZyx4W1uLYpyMPOLjhz
MD5 SHA1 SHA512 SSDEEP

Password

infected

LBLeak/builder.exe

IMPHASH d2e26e45dcb84f1062f90f29a9cf0faa
SHA256 e8e2deb0a83aebb1e2cc14846bc71715343372103f279d2d1622e383fb26d6ef
MD5 8c689dc9e82c9356b990d2b67b4943e1
SHA1 6bdc415b9c356bbeaea75c7336cd72910b95a644
SHA512 fb38a79dbcebde149736d5e1ca37dc15d274838be304d3f86e992d610b50c31d7fe4c30f6697c890f3753443af16eab712aef3f8da88d76ed00790083deb51e4
SSDEEP 12288:7tDkI5O/1MHOvEIfRfaXNCTL98vy7anEvY86vM1kiY4XotXpEKAoiO5wBmrkAUfM:7tQcOdu4BcCTL98vy7anEvY86vM1kiYt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

*(UJOISOj09(*)(*@)

Minor OS version

Major OS version

Entry point

15780

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

LBLeak/keygen.exe

IMPHASH 73eeda700d0a0376845c61c44155f4a8
SHA256 bb76f4d10ec2c1d24be904d2ee078f34a6b5bd11f3b40f295e116fea44824b89
MD5 5e28c7c900e4dce08366051c22f07f84
SHA1 ec03fd1551d31486e2f925d9c2db3b87ffcd7018
SHA512 fb45d7466d8a979ca78202be20175585e8d560a4cfcc81d3ef15edeb2d292cb5a05cdb93718cef685f1c8ee94cabf6c35ff010785d774057d045ba7b8a478a1e
SSDEEP 768:F6+T41GjHbdWCWDwDD01riWpJxKpAQJs/3JGIDLQH:E+U+hHIBpJxixgQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

*(UJOISOj09(*)(*@)

Minor OS version

Major OS version

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

3.7z

LBLeak/Build.bat

LBLeak/builder.exe

user32

kernel32

shell32

msvcrt

imagehlp

ntdll

generic

LBLeak/config.json

LBLeak/keygen.exe

user32

kernel32

shell32

msvcrt

generic