lockbit 2.0.zip
- SHA256 1bb1b363055c0422ac7c337156a68c5b62e25b669e3e801fdbc2424b6f96dc05
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Lockbit2.0/Mutated/Mutated_acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Lockbit2.0/Mutated/Mutated_acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
Lockbit2.0/acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
Lockbit2.0/acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target lockbit 2.0.zip
- Size 753KB
- Sample240915-dfry3asdrg
- SHA256 1bb1b363055c0422ac7c337156a68c5b62e25b669e3e801fdbc2424b6f96dc05
- MD5 2a021acf88271e1b3717e3bf0ab96a56
- SHA1 1011e0c5fe8c9cb4ae95683b91a726f5a69230d9
- SHA512 9f967d4f8c9240ed30d4315c0310025f3e109bd51bfb897c2b373a3e9efda6c94d3f0d3994e1a157d78ade41261eef2fd46e10d654d70fbbfdaf04016e628f3c
- SSDEEP 12288:oZ9lVl2MZ53ew46GtxRcr1KqPoffJ9L+2+f69MWgEQ37ZymGXQ8z/9vnM:orlV8k3pEi1Ufv+2NgEmZv+pvnM
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Lockbit2.0/Mutated/Mutated_acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe unpack001/Lockbit2.0/acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe
File Explorer
-
lockbit 2.0.zip.zip 753KB
-
Lockbit2.0/Mutated/Mutated_acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe.exe 959KB
-
Lockbit2.0/acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe.exe 959KB
Lockbit2.0/Mutated/Mutated_acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe
- IMPHASH 216df81b1ef7bc2aa8ec52bbeef137c9
- SHA256 66c817095a95ade8b25dc3c53c1f4da5714b3d3f5a72922e73b476d8f17b1703
- MD5 8b58d80d6650cea98b5dc6374a47e16e
- SHA1 c1eea96af2e60d2328dcade8beec7c8acd47ab39
- SHA512 8040b5a2be9fc0d89e4566dfe92c93c0297c2159c46361dd5c12715b53e4ee0d1ff83e887b621accfce0211fce876bc3b8e8bd1a4826f572f8b5da71a57ef344
- SSDEEP 24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdFFb:Ujrc2So1Ff+B3k796vx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
786320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathAppendW
activeds
ord9
ord15
kernel32
CreateProcessW
GetSystemTime
lstrlenW
LocalFree
advapi32
CheckTokenMembership
CreateWellKnownSid
ole32
CoCreateInstance
CoSetProxyBlanket
Name
.text
Size
896KB
Virtual Size
895KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
62KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
470B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26126,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=1, productName=Unmarked objects,
count=8, productName=Unmarked objects (old),
count=60, id=265, version=27043,
count=7, id=259, version=27043,
count=1, id=258, version=27043,
Lockbit2.0/acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c.exe
- IMPHASH 216df81b1ef7bc2aa8ec52bbeef137c9
- SHA256 acad2d9b291b5a9662aa1469f96995dc547a45e391af9c7fa24f5921b0128b2c
- MD5 84866fca8a5ceb187bca8e257e4f875a
- SHA1 038bc02c0997770a1e764d0203303ef8fcad11fb
- SHA512 aec85f1b12701d61dbc2d9343613ae99660a8580818ed5cff9c88e6d41fd8134b507af91ea06005eb1d0ec90dd28fc4d673e739007a92bd2edd4928aedd35f34
- SSDEEP 24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdFF:Ujrc2So1Ff+B3k796v
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
786320
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathAppendW
activeds
ord9
ord15
kernel32
CreateProcessW
GetSystemTime
lstrlenW
LocalFree
advapi32
CheckTokenMembership
CreateWellKnownSid
ole32
CoCreateInstance
CoSetProxyBlanket
Name
.text
Size
896KB
Virtual Size
895KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
62KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
470B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26126,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=18, id=1, productName=Unmarked objects,
count=8, productName=Unmarked objects (old),
count=60, id=265, version=27043,
count=7, id=259, version=27043,
count=1, id=258, version=27043,