Overview

overview

10

Static

static

10

LockBitRW.rar

windows11-21h2-x64

10

Debug/decryptor.exe

windows11-21h2-x64

10

Release/decryptor.exe

windows11-21h2-x64

10

builder.exe

windows11-21h2-x64

10

decryptor/...or.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    LockBitRW.rar

  • Size

    2.6MB

  • MD5

    cff570c34e99218bd2ae7454234082e3

  • SHA1

    7037992c0d898866ee344eb0a8f36b99d3603ea2

  • SHA256

    9ad0324340223dbe0dd10e61f2b497be6013b8840b5fda015e4c7296270d2122

  • SHA512

    22d6ea113e56707450995c5025467def6a91e4efae5f9d1b719cbe5eb9c6d499d693a40e14f4f65a685c98edff45a50fb9b5f4e80c2238bf7fa53308e2226613

  • SSDEEP

    49152:REmempzmEmeJS6+KWxxeEiqTwoGbC8aASHi8nNzFjVUWkEm3Q7iC3uEsTEmu:/eUUeINGokC8FH8NZjveg753Rslu

Score
10/10
rhadamanthys

Malware Config

Extracted

Family

rhadamanthys

C2

https://195.3.223.126:4287/9d0dc091285eb9fbf2e/o8f3c8oj.8rdif

Signatures

  • Rhadamanthys family
    rhadamanthys
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • LockBitRW.rar
    .rar
  • Debug/decryptor.exe
    .exe windows:4 windows x86 arch:x86

    eca0c30b65294d02a6c6180a6b323b58


    Headers

    Imports

    Sections

  • Debug/decryptor.ilk
  • Debug/decryptor.pdb
  • Release/R3ADM3.txt
  • Release/decryptor.exe
    .exe windows:4 windows x86 arch:x86

    eca0c30b65294d02a6c6180a6b323b58


    Headers

    Imports

    Sections

  • Release/decryptor.iobj
  • Release/decryptor.ipdb
  • Release/decryptor.pdb
  • builder.exe
    .exe windows:4 windows x86 arch:x86

    eca0c30b65294d02a6c6180a6b323b58


    Headers

    Imports

    Sections

  • builder/builder.vcxproj
    .xml
  • builder/builder.vcxproj.filters
  • builder/builder.vcxproj.user
  • decryptor/decryptor.exe
    .exe windows:4 windows x86 arch:x86

    eca0c30b65294d02a6c6180a6b323b58


    Headers

    Imports

    Sections

  • decryptor/decryptor.ilk
  • decryptor/decryptor.pdb
  • locker/Debug/locker.Build.CppClean.log
  • locker/Debug/locker.log
  • locker/Debug/vc142.idb
  • locker/Debug/vc142.pdb
  • locker/GetApi.h
  • locker/MetaRandom2.h
  • locker/MetaString.h
  • locker/Release/locker.Build.CppClean.log
  • locker/Release/locker.log
  • locker/Release/vc140.pdb
  • locker/antihook/antihooks.h
  • locker/api.h
  • locker/chacha20/chacha.c
  • locker/chacha20/chacha.h
  • locker/chacha20/ecrypt-config.h
  • locker/chacha20/ecrypt-machine.h
  • locker/chacha20/ecrypt-portable.h
  • locker/chacha20/ecrypt-sync.h
  • locker/common.h
  • locker/filesystem.h
  • locker/global_parameters.h
  • locker/hash.h
  • locker/locker.h
  • locker/locker.vcxproj
    .xml
  • locker/locker.vcxproj.filters
  • locker/locker.vcxproj.user
  • locker/logs.h
  • locker/memory.h
  • locker/network_scanner.h
  • locker/ntdll.h
  • locker/process_killer.h
  • locker/queue.h
  • locker/threadpool.h