lockbit | 16949606121[.]zip

General

Target
16949606121.zip
Size 108KB
Sample240430-k6d88agh23
SHA256 a80f54e1ef92eb5806486ac5a8c265ab50f26ce4c19a642dd03fe13f09693fc9
MD5 f40b874e38ad70cf8ab6aaa160df0623
SHA1 1f8c764505e6ac80ec8caebbec482f47cca65f36
SHA512 eeaed7b79fd57850b5e113d0dd2ccab87e00164e41d2e40f521f07ab2d472a7a659baa02e5a1b4382c21ee5877c77d618e83e297c5bcfda8c010af50596a0f6d
SSDEEP 1536:O4ZwKyIPOgkFHCUuXKSAxi7sMqbqV4l1HiaMC0LiwAU2SBtM5vvPjSRsOGhgvV:O4+IPkUUyKSOIoVliafNAKlOACV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2

File Explorer

16949606121.zip

.zip 108KB
1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2

.exe 194KB

16949606121.zip

SHA256 a80f54e1ef92eb5806486ac5a8c265ab50f26ce4c19a642dd03fe13f09693fc9
MD5 f40b874e38ad70cf8ab6aaa160df0623
SHA1 1f8c764505e6ac80ec8caebbec482f47cca65f36
SHA512 eeaed7b79fd57850b5e113d0dd2ccab87e00164e41d2e40f521f07ab2d472a7a659baa02e5a1b4382c21ee5877c77d618e83e297c5bcfda8c010af50596a0f6d
SSDEEP 1536:O4ZwKyIPOgkFHCUuXKSAxi7sMqbqV4l1HiaMC0LiwAU2SBtM5vvPjSRsOGhgvV:O4+IPkUUyKSOIoVliafNAKlOACV
MD5 SHA1 SHA512 SSDEEP

Password

infected

1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2
MD5 b7b4c97132d03eead1fa9a9352dee6c2
SHA1 c9eb1bdc528076fa9c91668addf0723294ac1575
SHA512 cb0023bc6783a94a27d2d4a67c214e8657fd334d1a94a7dba51277363dee2a67e7ecc5fc0788cead1c4e0e2dc7d9aa758203f89dce162184869d20a44d171903
SSDEEP 3072:v6glyuxE4GsUPnliByocWepXKD0/9Wy1Og/ZK99r:v6gDBGpvEByocWehKD0/EWfg3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

16949606121.zip

1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

16949606121.zip

1ecea8b0bc92378bf2bdd1c14ae1628c573569419b91cc34504d2c3f8bb9f8b2

gdi32

user32

kernel32

generic