lockbit | lb3[.]exe_17209092935[.]zip

General

Target
lb3.exe_17209092935.zip
Size 104KB
Sample240516-da98fsha7z
SHA256 414368c3a85deb96f2961fc49ea44c484a8e5756791efc7ff239e194596cb14e
MD5 749e79c30c8c583ac78ae2c7225d976d
SHA1 41258492cf2d2571430297723d82195d0b8c59bc
SHA512 1f515331b37e37036fa15e818e72c9ae5a8d084ffdd5784b28888a26822cbdc81bdc3c6bcebabb66108ea21781d9ab2529e6b2a901efd48ec098307596d55afe
SSDEEP 3072:J9Wjr3Yt8jKaqLm1hxoOQFOFGZBxvlG0Ognv:JEYt8DHAYY4I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/c9dd51d4295c33e1df0d275669a1de9e1de374a51eb88d7f7b1a1e65f49f7794	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/c9dd51d4295c33e1df0d275669a1de9e1de374a51eb88d7f7b1a1e65f49f7794

File Explorer

lb3.exe_17209092935.zip

.zip 104KB
c9dd51d4295c33e1df0d275669a1de9e1de374a51eb88d7f7b1a1e65f49f7794

.exe 153KB

lb3.exe_17209092935.zip

SHA256 414368c3a85deb96f2961fc49ea44c484a8e5756791efc7ff239e194596cb14e
MD5 749e79c30c8c583ac78ae2c7225d976d
SHA1 41258492cf2d2571430297723d82195d0b8c59bc
SHA512 1f515331b37e37036fa15e818e72c9ae5a8d084ffdd5784b28888a26822cbdc81bdc3c6bcebabb66108ea21781d9ab2529e6b2a901efd48ec098307596d55afe
SSDEEP 3072:J9Wjr3Yt8jKaqLm1hxoOQFOFGZBxvlG0Ognv:JEYt8DHAYY4I
MD5 SHA1 SHA512 SSDEEP

Password

infected

c9dd51d4295c33e1df0d275669a1de9e1de374a51eb88d7f7b1a1e65f49f7794

IMPHASH 914685b69f2ac2ff61b6b0f1883a054d
SHA256 c9dd51d4295c33e1df0d275669a1de9e1de374a51eb88d7f7b1a1e65f49f7794
MD5 8861ae48d8a851e1573586ac4b7ed230
SHA1 a379e55be365ece1ca2b8f72b6c54bb8b5bfe4e9
SHA512 2b6c452ec52e76c0e0750e3a94041cb7103fd36c5257067bb965cdb50af431fb55323c88e7b0c5b7f51a35be10f5cb60cc600a9dcece67093c6898603de61123
SSDEEP 3072:SqJogYkcSNm9V7DZqKbKV9oSIv/aoO3kYQDaT:Sq2kc4m9tDZqIEAKXUYQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

lb3.exe_17209092935.zip

c9dd51d4295c33e1df0d275669a1de9e1de374a51eb88d7f7b1a1e65f49f7794

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

lb3.exe_17209092935.zip

c9dd51d4295c33e1df0d275669a1de9e1de374a51eb88d7f7b1a1e65f49f7794

gdi32

user32

kernel32

generic