lockbit | 240626-cl8ckaydld_pw_infected[.]zip

General

Target

240626-cl8ckaydld_pw_infected.zip
Size

98KB
MD5

f643249de0d5e578f2981a520c560f21
SHA1

8b5970bab9cc2abacad4ad8078f3127eeff3bad3
SHA256

43336782406f2c2ba84b016942c64bfbbe82cfda32ade4ee6d93a41ba051bd34
SHA512

5fd8ab540ed5c8e41a943bb7b822b97754a0c86bb9156537a43bda1195e774b231d9419a1bbefb474bc938df9d5685a516f3ae4261ef0e4a02414a28f2bbdfea
SSDEEP

1536:etXSIEevNEPV8XhSpX1RMUDwKX6Ysq4qG48Cy9BBCcIKAeOZ54LzUR/di1o8+mzG:edSId1yOx8FDD7q9uc2/UK/M1Vfel

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack003/eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack003/eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

Files

240626-cl8ckaydld_pw_infected.zip
.zip

Password: infected
240618-k2pt6a1bjq_pw_infected.zip
.zip

Password: infected
17785798976.zip
.zip

Password: infected
eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
.exe windows:5 windows x86 arch:x86

Password: infected

41fb8cb2943df6de998b35a9d28668e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetPixel
SetDCBrushColor
SelectPalette
GetTextColor
GetDeviceCaps
CreateSolidBrush

user32

DefWindowProcW
CreateMenu
EndDialog
GetDlgItem
GetKeyNameTextW
GetMessageW
GetWindowTextW
IsDlgButtonChecked
LoadImageW
LoadMenuW
DialogBoxParamW

kernel32

SetLastError
LoadLibraryW
GetTickCount
GetLastError
GetCommandLineW
GetCommandLineA
FreeLibrary

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

Password: infected

41fb8cb2943df6de998b35a9d28668e8

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

kernel32

Sections

.text Size: 95KB - Virtual size: 95KB

.itext Size: 1KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 40KB - Virtual size: 43KB

.pdata Size: 3KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 95KB - Virtual size: 95KB

.itext
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 40KB - Virtual size: 43KB

.pdata
Size: 3KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 3KB