lockbit | f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb[.]zip

General

Target
f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb.zip
Size 102KB
Sample240426-b3fhfaha99
SHA256 f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb
MD5 6206618eb6eb4c44c57624e5aa5169a9
SHA1 bf9177ba136d26fdf670fb5688dbde4aead31667
SHA512 1725f8741c754483f1306b25b198fe607ceb3a2131f1b463279c137009a03e59d8ecafe04c7c93e3b13b50a507eced9a044985f50091a9e0708bfe1e6e27790a
SSDEEP 1536:yQ/YWWqGcA3eBfcLT7yC6u7LKFs4rYYEbqHl10xHJ77G7fr9hmdOlBEB3v:yQwJQVcLTOQKS4r1Oglmp7a9hmd+BEBf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/Document.doc.scr	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Document.doc.scr

File Explorer

f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb.zip

.zip 102KB
Document.doc.scr

.exe 194KB

f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb.zip

SHA256 f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb
MD5 6206618eb6eb4c44c57624e5aa5169a9
SHA1 bf9177ba136d26fdf670fb5688dbde4aead31667
SHA512 1725f8741c754483f1306b25b198fe607ceb3a2131f1b463279c137009a03e59d8ecafe04c7c93e3b13b50a507eced9a044985f50091a9e0708bfe1e6e27790a
SSDEEP 1536:yQ/YWWqGcA3eBfcLT7yC6u7LKFs4rYYEbqHl10xHJ77G7fr9hmdOlBEB3v:yQwJQVcLTOQKS4r1Oglmp7a9hmd+BEBf
MD5 SHA1 SHA512 SSDEEP

Document.doc.scr

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2
MD5 b7b4c97132d03eead1fa9a9352dee6c2
SHA1 c9eb1bdc528076fa9c91668addf0723294ac1575
SHA512 cb0023bc6783a94a27d2d4a67c214e8657fd334d1a94a7dba51277363dee2a67e7ecc5fc0788cead1c4e0e2dc7d9aa758203f89dce162184869d20a44d171903
SSDEEP 3072:v6glyuxE4GsUPnliByocWepXKD0/9Wy1Og/ZK99r:v6gDBGpvEByocWehKD0/EWfg3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb.zip

Document.doc.scr

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

f316c9478361d60b30205a8888e1dc227baa6a344521c21b0e616d853de9eedb.zip

Document.doc.scr

gdi32

user32

kernel32

generic