lockbit | d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15[.]zip

General

Target
d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15.zip
Size 102KB
Sample240427-b19cqsgd27
SHA256 d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15
MD5 6dfd06fe70cb840c97edb292ac4272ca
SHA1 2502cd18ad7db0536b3950bdbd66bf6cae488811
SHA512 aaed01ee6d724d099e3789c9a04b5e5bf8cae1870e3b39c06ee5b99d8870cf8b673083c64715df92c5a1c51b027b78364bc5759f4f252797c405d31a9f067959
SSDEEP 3072:6J1mfyam5pu+iKHGdeuHOJVTJd67vuehhl:6JiBU5imueuuJ7dqv9hhl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/Document.doc.scr	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Document.doc.scr

File Explorer

d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15.zip

.zip 102KB
Document.doc.scr

.exe 194KB

d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15.zip

SHA256 d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15
MD5 6dfd06fe70cb840c97edb292ac4272ca
SHA1 2502cd18ad7db0536b3950bdbd66bf6cae488811
SHA512 aaed01ee6d724d099e3789c9a04b5e5bf8cae1870e3b39c06ee5b99d8870cf8b673083c64715df92c5a1c51b027b78364bc5759f4f252797c405d31a9f067959
SSDEEP 3072:6J1mfyam5pu+iKHGdeuHOJVTJd67vuehhl:6JiBU5imueuuJ7dqv9hhl
MD5 SHA1 SHA512 SSDEEP

Document.doc.scr

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
MD5 6fd558cf3add096970e15d1e62ca1957
SHA1 78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23
SHA512 fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc
SSDEEP 3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15.zip

Document.doc.scr

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

d212718eb644c7803f73dc13b55536e84263a3f959219bd067dc4092a2095b15.zip

Document.doc.scr

gdi32

user32

kernel32

generic