lockbit | 19759920078[.]zip

General

Target
19759920078.zip
Size 96KB
Sample241104-sdg4easbpq
SHA256 49a859131e6e30e4fb1500971e1ad1881238cea607c915f82c2dfcb392305e0c
MD5 69a045ea5f33a8f0c855be6bdd050138
SHA1 a29a5485c23677887333fef7a42f9b1a391615db
SHA512 867ea226bd5f300c550873e1e29640c961ff40302d4129fa668aad27dad7abc3f191e859a954ca064e6c0003fcd836cf209041dd0ae013208a931a65fb450f1d
SSDEEP 3072:h15A92RZbtkx4fcLkKKHNjRb+NhgnS/JRuvOmqYLN0IPu:h/dRWVytdb+LgnSBR3yLm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/6285344b97b9438ab032899fdd564c1a45451abd43cdeaa91f938c020dcac04c	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6285344b97b9438ab032899fdd564c1a45451abd43cdeaa91f938c020dcac04c

File Explorer

19759920078.zip

.zip 96KB
6285344b97b9438ab032899fdd564c1a45451abd43cdeaa91f938c020dcac04c

.exe 145KB

19759920078.zip

SHA256 49a859131e6e30e4fb1500971e1ad1881238cea607c915f82c2dfcb392305e0c
MD5 69a045ea5f33a8f0c855be6bdd050138
SHA1 a29a5485c23677887333fef7a42f9b1a391615db
SHA512 867ea226bd5f300c550873e1e29640c961ff40302d4129fa668aad27dad7abc3f191e859a954ca064e6c0003fcd836cf209041dd0ae013208a931a65fb450f1d
SSDEEP 3072:h15A92RZbtkx4fcLkKKHNjRb+NhgnS/JRuvOmqYLN0IPu:h/dRWVytdb+LgnSBR3yLm
MD5 SHA1 SHA512 SSDEEP

Password

infected

6285344b97b9438ab032899fdd564c1a45451abd43cdeaa91f938c020dcac04c

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 6285344b97b9438ab032899fdd564c1a45451abd43cdeaa91f938c020dcac04c
MD5 99c73a4ed67ee6c30ca7dff7ef40a799
SHA1 9ae279860f981383fec5c6f9d744dfedede1a4aa
SHA512 1c643f86c1db3f8c1b4a88a3752f72d8e235268f31beb0a51764eb634611f2cb19a2785b9f6c1b0cf7696017a43df0308426c45f74a030a4ba743835342a5c1b
SSDEEP 1536:LzICS4AwwRlcz5AxE4vGP1iU8KnliIs3iocZMgkGJp1qVQg2IFPTjf9giArmDYAm:06glyuxE4GsUPnliByocWepothj2+w
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

19759920078.zip

6285344b97b9438ab032899fdd564c1a45451abd43cdeaa91f938c020dcac04c

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

19759920078.zip

6285344b97b9438ab032899fdd564c1a45451abd43cdeaa91f938c020dcac04c

gdi32

user32

kernel32

generic