Behavioral task
behavioral1
Sample
2024-04-19_2fe81f696d192f60b7ab3eec932f147f_lockbit.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-19_2fe81f696d192f60b7ab3eec932f147f_lockbit.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-19_2fe81f696d192f60b7ab3eec932f147f_lockbit
-
Size
152KB
-
MD5
2fe81f696d192f60b7ab3eec932f147f
-
SHA1
45fc8064a8261b17d1d536fd2266591b94bf37bd
-
SHA256
07ec93da4d8b9ea2450d35cd2b24bc49f2205771daa782793827a020ccf313d6
-
SHA512
26c8e08cf4651c8bedb34932d4bc314bdc606c6020ca2afb03dbc57fca04730fe1c892e7556f729d4d533c55952808a2161bdc2badae90c1ba7b8c8a2673e683
-
SSDEEP
3072:9X8idQ477CpgkAbKtYN0LfHe9ri/EJOM9isUgUy9+RJN4XY+7Oar4191ES/5:9k4779k2eLmOMYJgj+RIY+71Q1ES/5
Malware Config
Signatures
-
Lockbit family
-
Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule sample family_lockbit -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-19_2fe81f696d192f60b7ab3eec932f147f_lockbit
Files
-
2024-04-19_2fe81f696d192f60b7ab3eec932f147f_lockbit.exe windows:5 windows x86 arch:x86
3bc510de773c954bd69d33670cb624d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap
user32
LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW
kernel32
GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW
Sections
.text Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.itext Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE