lockbit | e990e7571cdb06c5d0f093176cecf414[.]bin

General

Target
e990e7571cdb06c5d0f093176cecf414.bin
Size 104KB
Sample240501-cctstadd5t
SHA256 a8df5f31d17553bdad8b5170e86fed04e2b0762711dc89830a0ba0acdf3b6e71
MD5 1e1adaf378935ff8fdcdc55ee61525a0
SHA1 2e6cfb796edfb162ecdbb5def4061b43e2023d7d
SHA512 05c7473b3f2f4575adde1c39d3464299fc0f1dd8dfc1a4f1ab1292dc2c14419c75205bb94a5fe2e44d43fb21aa85986a60dca980076d4eaf3bca2f8ff8aa34fa
SSDEEP 3072:zMiGkicO9xg3WjXMhkqoJAJ5wnsSzADoahY0W5:lGhxh8mAJGdAkaa0U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe

File Explorer

e990e7571cdb06c5d0f093176cecf414.bin

.zip 104KB
a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe

.exe 194KB

e990e7571cdb06c5d0f093176cecf414.bin

SHA256 a8df5f31d17553bdad8b5170e86fed04e2b0762711dc89830a0ba0acdf3b6e71
MD5 1e1adaf378935ff8fdcdc55ee61525a0
SHA1 2e6cfb796edfb162ecdbb5def4061b43e2023d7d
SHA512 05c7473b3f2f4575adde1c39d3464299fc0f1dd8dfc1a4f1ab1292dc2c14419c75205bb94a5fe2e44d43fb21aa85986a60dca980076d4eaf3bca2f8ff8aa34fa
SSDEEP 3072:zMiGkicO9xg3WjXMhkqoJAJ5wnsSzADoahY0W5:lGhxh8mAJGdAkaa0U
MD5 SHA1 SHA512 SSDEEP

Password

infected

a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616
MD5 e990e7571cdb06c5d0f093176cecf414
SHA1 409fc0816adbf05ac1586112044401ecb90c8022
SHA512 9719fb45a0cd79ba8d51c3d052fe76dcb6d1b5b677a5398cc4fdbe6373d8763d2b0c3375929f41c5a0e46237b4a3f660b0b7f6a4f8a24ea47d52074da69baa64
SSDEEP 3072:A6glyuxE4GsUPnliByocWepzdBaChENI/NBpke:A6gDBGpvEByocWelq+V
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

e990e7571cdb06c5d0f093176cecf414.bin

a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

e990e7571cdb06c5d0f093176cecf414.bin

a18a6bacc0d8b1dd4544cdf1e178a98a36b575b5be8b307c27c65455b1307616.exe

gdi32

user32

kernel32

generic