lockbit | 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86[.]zip

General

Target

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.zip
Size

92KB
MD5

c9f3e288b89dbf86e80a3e50de0373e7
SHA1

516eceaa0ec1d9e9761e6cb5ca47ad8d2252c013
SHA256

bb176c4f2cbbe4f80f3efcde3121d0ec79a2c05f9825f20445cd0b34aa05e483
SHA512

14c78d7781c8bf190a87682c7fb50d3246b39c168d9b686f8c07463d6de0070910eb1bdf01835f3380c4a4f7bfebd1678bcf5332a294b3b2a2e4d49151716e2d
SSDEEP

1536:rPl7hGyC0AvYCLgAll8xTPncLzkKkUhpwc7783SU1qXk9PoDSAEi1uoQq+vmRV3:rPlFGyaVLgAlI2YKNhpwc7I3SUgkmDSw

Score

10^/10

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.zip
.zip

Password: infected
311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe
.exe windows:5 windows x86 arch:x86

Password: infected

914685b69f2ac2ff61b6b0f1883a054d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetPixel
GetPixel
SelectPalette
SelectObject
GetTextColor
BitBlt
GetDeviceCaps
CreateSolidBrush
CreateFontW
CreateDIBitmap

user32

LoadMenuW
LoadImageW
CreateDialogParamW
CreateWindowExW
DefWindowProcW
GetDlgItem
IsDlgButtonChecked

kernel32

GetLastError
GetProcAddress
GetModuleHandleA
GetLocaleInfoW
FreeLibrary
GetFileAttributesW
GetCommandLineW
GetCommandLineA

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ