lockbit | 17785798976[.]zip | Triage

Resubmissions

18-06-2024 09:06

240618-k2pt6a1bjq 10

Sharing

General

Target

17785798976.zip
Size

98KB
MD5

9cb96848386327410ca588b6cd5f6401
SHA1

968c4ae64dcb71c9eeffd812ef38a69d5548b3bb
SHA256

0ed5729655b3f09c29878e1cc10de55e0cbfae7ac344f574d471827c256cf086
SHA512

9376295b1dec89b18929b182a15a76163429f238a222b58d112c33006f19f33411314554fa5dbe12280d1278a17d5be04bc78aa52636965e7597d28153270940
SSDEEP

3072:XVNK3GFlSbCrEEcoDhYXARN1fKxf4vV9pN:XPKCyodNYxwvpN

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

Files

17785798976.zip
.zip

Password: infected
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
.exe windows:5 windows x86 arch:x86

Password: infected

41fb8cb2943df6de998b35a9d28668e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetPixel
SetDCBrushColor
SelectPalette
GetTextColor
GetDeviceCaps
CreateSolidBrush

user32

DefWindowProcW
CreateMenu
EndDialog
GetDlgItem
GetKeyNameTextW
GetMessageW
GetWindowTextW
IsDlgButtonChecked
LoadImageW
LoadMenuW
DialogBoxParamW

kernel32

SetLastError
LoadLibraryW
GetTickCount
GetLastError
GetCommandLineW
GetCommandLineA
FreeLibrary

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ