lockbit | test3[.]zip

General

Target
test3.zip
Size 102KB
Sample241004-kbg2maxhmf
SHA256 28664daf83a19ae6efd7caf9433600981fbb7c95025f473dc4e6099b603512a0
MD5 0e325d00fd30af4577f7a1df57a67b3f
SHA1 a3f86e3a702dba6582b967217e411af3b662d771
SHA512 5802d619ffb5bba93183d2d1ccb25c516e13e6ed801b37737a8aafeeb3577c8a12bf36308eb57f6621e69e2589b82f1fd7d4c4b4b669c3df4622acae22faa1c7
SSDEEP 3072:Wwa7KxzWhIKXRzJUGdje+7Yenbw85eNwnaYeW02aa:Wwa7NhIKYG0+EeHeSa912aa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

File Explorer

test3.zip

.zip 102KB
a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

.exe 162KB
nothing.txt

96B

test3.zip

SHA256 28664daf83a19ae6efd7caf9433600981fbb7c95025f473dc4e6099b603512a0
MD5 0e325d00fd30af4577f7a1df57a67b3f
SHA1 a3f86e3a702dba6582b967217e411af3b662d771
SHA512 5802d619ffb5bba93183d2d1ccb25c516e13e6ed801b37737a8aafeeb3577c8a12bf36308eb57f6621e69e2589b82f1fd7d4c4b4b669c3df4622acae22faa1c7
SSDEEP 3072:Wwa7KxzWhIKXRzJUGdje+7Yenbw85eNwnaYeW02aa:Wwa7NhIKYG0+EeHeSa912aa
MD5 SHA1 SHA512 SSDEEP

a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

IMPHASH a50a0d82b9120fc73965c28fea79e1f9
SHA256 a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e
MD5 03b14473eef5b7e38d9a5041c1af0a76
SHA1 371353e9564c58ae4722a03205ac84ab34383d8c
SHA512 eb39446791d4cdbfcd13dfc3ee1902cbc80f946d177e53a2927ef1e53257113e904ae5b5711a5622769b45bfcb961cd9c33158ad9c1f5e1258ff91d8bc753615
SSDEEP 3072:o5uyulsHwDV1gFnTwn7zwJGJ+ut5kCI5Gzei3N2VzRmK:o5uZ1DPgFnk7EJwZI5gDN2VVm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

111727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

test3.zip

a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

gdi32

user32

kernel32

generic

nothing.txt

Sharing

General

Malware Config

Signatures

File Explorer

test3.zip

a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e.exe.bin

gdi32

user32

kernel32

generic

nothing.txt