lockbit.zip
- SHA256 9e1342e551b8eec0a18eb329f1968b9d81023e1152a15702fc901d8d129c16c2
Behavioral task
behavioral1
Sample
lb.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
lb.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
lbb.exe
Resource
win7-20240215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral4
Sample
lbb.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target lockbit.zip
- Size 203KB
- Sample240430-sxxcfaaa41
- SHA256 9e1342e551b8eec0a18eb329f1968b9d81023e1152a15702fc901d8d129c16c2
- MD5 931e705e45ad0a5f0e5845636d03c922
- SHA1 e5d04b01cf0089d017a82ffbf69ae8b4acde2a62
- SHA512 059454fb084f9af77cb1bdaeed37256517445e52e5978a8bba254763da6623fd074bcf8e10d01cbc3cafa4b2616c735ae4d8a6f28eb9b2c5c0313f03c951374d
- SSDEEP 3072:9BXTH5uXDVoKoXsciMGb/Ou/SRzkhNZlcA/WtXRviGkx0jo1VuAXEfq9nygdc3k5:9NQCVipOu/GWNh/EAL0fq92kcK
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Lockbit family
- Rule to detect Lockbit 3.0 ransomware Windows payload 2 IoCs
resource yara_rule static1/unpack001/lb.exe family_lockbit static1/unpack001/lbb.exe family_lockbit - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/lb.exe unpack001/lbb.exe
File Explorer
-
lockbit.zip.zip 203KB
-
lb.exe.exe 194KB
-
lbb.exe.exe 194KB
lb.exe
- IMPHASH 41fb8cb2943df6de998b35a9d28668e8
- SHA256 41e187191625d749b89a11bc04fc0b2a3b9bd638035d05b39365c47ab36d1898
- MD5 6fd558cf3add096970e15d1e62ca1957
- SHA1 78e95fabcfe8ef7bb6419f8456deccc3d5fa4c23
- SHA512 fac7efe9b76f9b6a917f8751f5be64ad8e067e5404fe05f3e9d7781ea3661a06c0baaac676a6023eb4a0b7f01bc2bb2d64d572f85aec8ad8de35cc7f106e1fdc
- SSDEEP 3072:n6glyuxE4GsUPnliByocWepMhJL4BFkTGX:n6gDBGpvEByocWeyhJL4UK
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
103535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
SetDCBrushColor
SelectPalette
GetTextColor
GetDeviceCaps
CreateSolidBrush
user32
DefWindowProcW
CreateMenu
EndDialog
GetDlgItem
GetKeyNameTextW
GetMessageW
GetWindowTextW
IsDlgButtonChecked
LoadImageW
LoadMenuW
DialogBoxParamW
kernel32
SetLastError
LoadLibraryW
GetTickCount
GetLastError
GetCommandLineW
GetCommandLineA
FreeLibrary
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
lbb.exe
- IMPHASH 41fb8cb2943df6de998b35a9d28668e8
- SHA256 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616
- MD5 e990e7571cdb06c5d0f093176cecf414
- SHA1 409fc0816adbf05ac1586112044401ecb90c8022
- SHA512 9719fb45a0cd79ba8d51c3d052fe76dcb6d1b5b677a5398cc4fdbe6373d8763d2b0c3375929f41c5a0e46237b4a3f660b0b7f6a4f8a24ea47d52074da69baa64
- SSDEEP 3072:A6glyuxE4GsUPnliByocWepzdBaChENI/NBpke:A6gDBGpvEByocWelq+V
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
103535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
gdi32
SetPixel
SetDCBrushColor
SelectPalette
GetTextColor
GetDeviceCaps
CreateSolidBrush
user32
DefWindowProcW
CreateMenu
EndDialog
GetDlgItem
GetKeyNameTextW
GetMessageW
GetWindowTextW
IsDlgButtonChecked
LoadImageW
LoadMenuW
DialogBoxParamW
kernel32
SetLastError
LoadLibraryW
GetTickCount
GetLastError
GetCommandLineW
GetCommandLineA
FreeLibrary
Name
.text
Size
95KB
Virtual Size
95KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ