lockbit | test3[.]zip

General

Target
test3.zip
Size 102KB
Sample241004-j96l7stdmr
SHA256 bbe275683f3c65d415877b5d1f469b4ddec1069bd3891a7a89b47b43a43e8ce4
MD5 2ad917c24d22e27eccab6428f23baa8f
SHA1 d453e717149d58e94fce377ff7b74f888007848f
SHA512 545b64c26ed060b12dc1a466f3749918d72dde2baa41105cddba787361973d86b8907020a44b88dd1e113e57ccfa14478edd64bba15c74ef2963343b6b4d0a20
SSDEEP 3072:Wwa7KxzWhIKXRzJUGdje+7Yenbw85eNwnaYeW02aw:Wwa7NhIKYG0+EeHeSa912aw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

File Explorer

test3.zip

.zip 102KB
a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

.exe 162KB
nothing.txt

7B

test3.zip

SHA256 bbe275683f3c65d415877b5d1f469b4ddec1069bd3891a7a89b47b43a43e8ce4
MD5 2ad917c24d22e27eccab6428f23baa8f
SHA1 d453e717149d58e94fce377ff7b74f888007848f
SHA512 545b64c26ed060b12dc1a466f3749918d72dde2baa41105cddba787361973d86b8907020a44b88dd1e113e57ccfa14478edd64bba15c74ef2963343b6b4d0a20
SSDEEP 3072:Wwa7KxzWhIKXRzJUGdje+7Yenbw85eNwnaYeW02aw:Wwa7NhIKYG0+EeHeSa912aw
MD5 SHA1 SHA512 SSDEEP

a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

IMPHASH a50a0d82b9120fc73965c28fea79e1f9
SHA256 a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e
MD5 03b14473eef5b7e38d9a5041c1af0a76
SHA1 371353e9564c58ae4722a03205ac84ab34383d8c
SHA512 eb39446791d4cdbfcd13dfc3ee1902cbc80f946d177e53a2927ef1e53257113e904ae5b5711a5622769b45bfcb961cd9c33158ad9c1f5e1258ff91d8bc753615
SSDEEP 3072:o5uyulsHwDV1gFnTwn7zwJGJ+ut5kCI5Gzei3N2VzRmK:o5uZ1DPgFnk7EJwZI5gDN2VVm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

111727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

test3.zip

a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

gdi32

user32

kernel32

generic

nothing.txt

Sharing

General

Malware Config

Signatures

File Explorer

test3.zip

a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

gdi32

user32

kernel32

generic

nothing.txt