lockbit | d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27

General

Target
d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27
Size 93KB
Sample240818-dm47zavepr
SHA256 d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27
MD5 e235430be8eab293f1875debf5c4763c
SHA1 6e1554846d507392daf2928c1b37225408631a48
SHA512 8f635affdf6554846e9a2365461545f77bd80e38c2f3acff0fdd10e0b1926f0a2de21600e5f0a43e8c9c86d93a598014902583fb9d112a6f006ac8bf963dd98c
SSDEEP 1536:SeZJ9CEvPSHpbwB+tZA3R/KRWj2Q7PHpdfCgRxrOuvgFy3e23bUEOdKLrFfsISB:F9CYPSuwYR/KR42aJB7RJjNrUkMB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe

File Explorer

d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27

.zip 93KB
315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe

.exe 146KB

d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27

SHA256 d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27
MD5 e235430be8eab293f1875debf5c4763c
SHA1 6e1554846d507392daf2928c1b37225408631a48
SHA512 8f635affdf6554846e9a2365461545f77bd80e38c2f3acff0fdd10e0b1926f0a2de21600e5f0a43e8c9c86d93a598014902583fb9d112a6f006ac8bf963dd98c
SSDEEP 1536:SeZJ9CEvPSHpbwB+tZA3R/KRWj2Q7PHpdfCgRxrOuvgFy3e23bUEOdKLrFfsISB:F9CYPSuwYR/KR42aJB7RJjNrUkMB
MD5 SHA1 SHA512 SSDEEP

Password

infected

315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe

IMPHASH 914685b69f2ac2ff61b6b0f1883a054d
SHA256 315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13
MD5 6edfb62405f50d7fb16882ca9b16ed36
SHA1 73c346267e9527ca5886bf8a90b77f9ebceb58fe
SHA512 b3ea04a001c846af5d93435db055986a448fc5d01e86a9292937ce085609b653d41719111d2d031c8b6694eb01d5856e86f9e1a65e8cdc43af51a8ed3d370d2f
SSDEEP 3072:PqJogYkcSNm9V7DGoNK696RTpfnEsCygHQlyT:Pq2kc4m9tDHNK6UlJ9CyN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27

315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

d27b559ed86eae5b135acae621d59c976102ca538ca16470a7bca76106824c27

315d043b99f988ce9d9f69d7225292eb44623a97c1a029933b62ede699fa9f13.exe

gdi32

user32

kernel32

generic