lockbit | b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200[.]zip

General

Target
b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.zip
Size 100KB
Sample240828-e8y4hsxblj
SHA256 90c2a8c85d37811520533e0d1bd3d394f279590170b4dfb2fd39b892212cadfe
MD5 3c09f0b9444ce56a113d15993e8ad10f
SHA1 0912e6124c853953b3728934a52ab7beb84af3cd
SHA512 c1d950a5b8567d7ec7493b9d047e82a7609be1211b9cbc51d697356425f3c37ea0bb53c3012930aa5aa3de511ccb6ab5ca904a547996106a1cddd3fab47d95d0
SSDEEP 3072:Dt4sApdt1XSnURGBGZmoFlIShbX3c3Ik54YtiwQ:D7idXg2iGZmsGObX3c3IWTtHQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.exe

File Explorer

b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.zip

.zip 100KB
b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.exe

.exe 153KB

b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.zip

SHA256 90c2a8c85d37811520533e0d1bd3d394f279590170b4dfb2fd39b892212cadfe
MD5 3c09f0b9444ce56a113d15993e8ad10f
SHA1 0912e6124c853953b3728934a52ab7beb84af3cd
SHA512 c1d950a5b8567d7ec7493b9d047e82a7609be1211b9cbc51d697356425f3c37ea0bb53c3012930aa5aa3de511ccb6ab5ca904a547996106a1cddd3fab47d95d0
SSDEEP 3072:Dt4sApdt1XSnURGBGZmoFlIShbX3c3Ik54YtiwQ:D7idXg2iGZmsGObX3c3IWTtHQ
MD5 SHA1 SHA512 SSDEEP

Password

infected

b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.exe

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200
MD5 096d1b1e03a8662e0c66aa25934ef00d
SHA1 69ac141499613dec8006f41e0e0928aa3af5faac
SHA512 2174d82ca72e93b027e0cd5875780354295b185fa5dce9f37515e5a7c4cc670581991bc8ac027d87fdda92c1eb853626ee209247f815bf432d41e9ff79e2c2a4
SSDEEP 3072:u6glyuxE4GsUPnliByocWepDsFqHudJ5B7lsggt:u6gDBGpvEByocWeN2fPBJHg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.zip

b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.zip

b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200.exe

gdi32

user32

kernel32

generic