lockbit | 76b23dd72a883d8b1302bb4a514b7967[.]bin

General

Target
76b23dd72a883d8b1302bb4a514b7967.bin
Size 92KB
Sample240531-cyvx1ada94
SHA256 5721e6a09cf912aa329fa275aa665932ada075edc890be4cf98e9adaf1b3701c
MD5 53a4fbd0129968220db604fb9c622dfa
SHA1 1c807085d195e2aae6f11f07e8b4779037393d21
SHA512 5e1476cc1ea5808efa27d32dc617bc7b7043fed57aba72d705bed706d79d28c2c81c4d925774548c3021018112823088fbc465d4ef39d4472bc978f70f53b4f5
SSDEEP 1536:rdOQKxXqnzP3XjV7Meg1qKuGGoJackUgyLOLbLlUDR6uuh3FKjXFQR66gk7w:rGXynFMegkGhJNQyCL1UDR5wFKjSo6gv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

File Explorer

76b23dd72a883d8b1302bb4a514b7967.bin

.zip 92KB
311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

.exe 145KB

76b23dd72a883d8b1302bb4a514b7967.bin

SHA256 5721e6a09cf912aa329fa275aa665932ada075edc890be4cf98e9adaf1b3701c
MD5 53a4fbd0129968220db604fb9c622dfa
SHA1 1c807085d195e2aae6f11f07e8b4779037393d21
SHA512 5e1476cc1ea5808efa27d32dc617bc7b7043fed57aba72d705bed706d79d28c2c81c4d925774548c3021018112823088fbc465d4ef39d4472bc978f70f53b4f5
SSDEEP 1536:rdOQKxXqnzP3XjV7Meg1qKuGGoJackUgyLOLbLlUDR6uuh3FKjXFQR66gk7w:rGXynFMegkGhJNQyCL1UDR5wFKjSo6gv
MD5 SHA1 SHA512 SSDEEP

Password

infected

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

IMPHASH 914685b69f2ac2ff61b6b0f1883a054d
SHA256 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86
MD5 76b23dd72a883d8b1302bb4a514b7967
SHA1 338e19e8a3615c29d8a825ebba66cf55fa0caa2c
SHA512 39d98f914ec9d8551a894306163bc726f035f9228f3f198de78555988cea5a7b423be8c2a19913c76b996220a81a9b3a257b7f0af67913aa8a50b77321b17735
SSDEEP 1536:azICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtCYU0GsvgtwjECrozUYj3PeAU2:pqJogYkcSNm9V7DtCCGsg+AmYylQhTT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

76b23dd72a883d8b1302bb4a514b7967.bin

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

76b23dd72a883d8b1302bb4a514b7967.bin

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

gdi32

user32

kernel32

generic