lockbit | 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86[.]zip

General

Target
311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.zip
Size 92KB
Sample241106-hcksssvmfs
SHA256 bb176c4f2cbbe4f80f3efcde3121d0ec79a2c05f9825f20445cd0b34aa05e483
MD5 c9f3e288b89dbf86e80a3e50de0373e7
SHA1 516eceaa0ec1d9e9761e6cb5ca47ad8d2252c013
SHA512 14c78d7781c8bf190a87682c7fb50d3246b39c168d9b686f8c07463d6de0070910eb1bdf01835f3380c4a4f7bfebd1678bcf5332a294b3b2a2e4d49151716e2d
SSDEEP 1536:rPl7hGyC0AvYCLgAll8xTPncLzkKkUhpwc7783SU1qXk9PoDSAEi1uoQq+vmRV3:rPlFGyaVLgAlI2YKNhpwc7I3SUgkmDSw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

File Explorer

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.zip

.zip 92KB
311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

.exe 145KB

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.zip

SHA256 bb176c4f2cbbe4f80f3efcde3121d0ec79a2c05f9825f20445cd0b34aa05e483
MD5 c9f3e288b89dbf86e80a3e50de0373e7
SHA1 516eceaa0ec1d9e9761e6cb5ca47ad8d2252c013
SHA512 14c78d7781c8bf190a87682c7fb50d3246b39c168d9b686f8c07463d6de0070910eb1bdf01835f3380c4a4f7bfebd1678bcf5332a294b3b2a2e4d49151716e2d
SSDEEP 1536:rPl7hGyC0AvYCLgAll8xTPncLzkKkUhpwc7783SU1qXk9PoDSAEi1uoQq+vmRV3:rPlFGyaVLgAlI2YKNhpwc7I3SUgkmDSw
MD5 SHA1 SHA512 SSDEEP

Password

infected

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

IMPHASH 914685b69f2ac2ff61b6b0f1883a054d
SHA256 311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86
MD5 76b23dd72a883d8b1302bb4a514b7967
SHA1 338e19e8a3615c29d8a825ebba66cf55fa0caa2c
SHA512 39d98f914ec9d8551a894306163bc726f035f9228f3f198de78555988cea5a7b423be8c2a19913c76b996220a81a9b3a257b7f0af67913aa8a50b77321b17735
SSDEEP 1536:azICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDtCYU0GsvgtwjECrozUYj3PeAU2:pqJogYkcSNm9V7DtCCGsg+AmYylQhTT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.zip

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

gdi32

user32

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.zip

311edf744c2e90d7bfc550c893478f43d1d7977694d5dcecf219795f3eb99b86.exe

gdi32

user32

kernel32

generic