lockbit | Document[.]zip

Resubmissions

30/04/2024, 10:29

240430-mjb7fshh7410

26/04/2024, 02:29

240426-cytpyahd2310

26/04/2024, 02:23

240426-cvm3zshc8210

25/04/2024, 03:51

240425-eekn2aeg3910

Sharing

Copy URL Twitter E-mail

General

Target
Document.zip
Size 102KB
Sample240425-eekn2aeg39
SHA256 0c52f70b4c340274208310ef1c9c09eee3124fb58063aee0c010a9645e417650
MD5 b93f78a3953216d9d7b2641052ee2fbd
SHA1 d1669609fb605781218a19dd76630cd8eb3ee3f1
SHA512 c8327a691e6dd32fc7c508e2f417fb5247bb556cd9132b5fd97da2335a8021b2077b8a24a74d618b308c9f141e6970faf968b9d320b38e7477621661b7abc5b8
SSDEEP 3072:Oe2faB+tjQs7HwYeFsbsTlwaZqid911YO4ESlbK:Oe2fgcwsGlh4inrYO4K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/Document.doc.scr	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Document.doc.scr

File Explorer

Document.zip

.zip 102KB
Document.doc.scr

.exe 194KB

Document.zip

SHA256 0c52f70b4c340274208310ef1c9c09eee3124fb58063aee0c010a9645e417650
MD5 b93f78a3953216d9d7b2641052ee2fbd
SHA1 d1669609fb605781218a19dd76630cd8eb3ee3f1
SHA512 c8327a691e6dd32fc7c508e2f417fb5247bb556cd9132b5fd97da2335a8021b2077b8a24a74d618b308c9f141e6970faf968b9d320b38e7477621661b7abc5b8
SSDEEP 3072:Oe2faB+tjQs7HwYeFsbsTlwaZqid911YO4ESlbK:Oe2fgcwsGlh4inrYO4K
MD5 SHA1 SHA512 SSDEEP

Document.doc.scr

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 062683257386c9e41a1cd1493f029d817445c37f7c65386d54122fa466419ce1
MD5 50e5dec57451005668704281688ca55d
SHA1 67dd4ac7eb8c193b39149b34d3a0d5bc21c3f200
SHA512 29ca4a44795c71d3e2b4e3417355ebb93765157d464d6d5a3fe6774056d934d57081c72001fb29e47982da11e5a5ccfdbcc958d05a11fb49bd8bf84e6d0c61ad
SSDEEP 3072:66glyuxE4GsUPnliByocWepRGbVZqid91h2ys+tU:66gDBGpvEByocWeubV4inP9B
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Document.zip

Document.doc.scr

gdi32

user32

kernel32

generic