lockbit | Builds[.]7z

Resubmissions

02-01-2025 21:27

250102-1arsfawnat 10

21-12-2024 14:36

241221-ryt32a1mhx 10

Sharing

Copy URL

Twitter E-mail

General

Target

Builds.7z
Size

1.8MB
MD5

484933f81970182e04f190efe2527da1
SHA1

72f0810a0ab7f1398ba9f0b0916ee97115e79cc4
SHA256

3968a850f5bc70d954bb5609d929f181a6f05a117fa3be4531cbd96cedfde5d6
SHA512

d9d5d96e13201de976d23783e077bb1f95af3946a44bd1347d637893e471eefed5d9b0de4a7d84d8d2040decf8cea4e3de83555b2424e58ebbc1c7eb4881e37a
SSDEEP

49152:bor7D7eZFTWD/gjKZ4FhydMzOoSGSW7TeXY:UfeZFT48HSCilTWB

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 3 IoCs

resource	yara_rule
static1/unpack003/LBB.exe	family_lockbit
static1/unpack003/LBB_Rundll32_pass.dll	family_lockbit
static1/unpack003/LBB_pass.exe	family_lockbit

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack003/LBB.exe
unpack003/LBB_ReflectiveDll_DllMain.dll
unpack003/LBB_Rundll32.dll
unpack003/LBB_Rundll32_pass.dll
unpack003/LBB_pass.exe
unpack009/FC8E43EC21BE9047/lbg32.exe
unpack009/FC8E43EC21BE9047/lbg64.exe

Files

Builds.7z
.7z

Password: infected
Builds/ESXi_vx-_____________329D6F9DDBF138D4_19.12.24_i_love_anime.zip
.zip .ps1 polyglot

Password: infected
329D6F9DDBF138D4/locker_ESXI_I386
.elf linux x86
329D6F9DDBF138D4/locker_ESXI_X64
.elf linux x64
Builds/LBB_vx-_____________07AAB9B790E0235B_19.12.24_hacking_is_bad.zip
.zip

Password: infected
LBB.exe
.exe windows:5 windows x86 arch:x86

Password: infected

3bc510de773c954bd69d33670cb624d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap

user32

LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW

kernel32

GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LBB_PS1.ps1
LBB_PS1_obfuscated.ps1
.ps1
LBB_PS1_pass.ps1
LBB_ReflectiveDll_DllMain.dll
.dll windows:5 windows x86 arch:x86

Password: infected

bfce782cfa0e2f22c598571118d3f91d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

SelectObject
TextOutW
SetTextColor
SelectPalette
BitBlt
GetTextCharset
CreateSolidBrush
CreateFontW

user32

LoadMenuW
CreateMenu
DialogBoxParamW
EndDialog
GetClassNameW
GetDlgItem
GetDlgItemTextW
GetKeyNameTextW
GetWindowTextW
IsDlgButtonChecked
LoadImageW

kernel32

SetLastError
GetProcAddress
GetModuleHandleW
GetFileAttributesW
GetDateFormatW
GetCommandLineW
FreeLibrary

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LBB_Rundll32.dll
.dll windows:5 windows x86 arch:x86

Password: infected

a6e537c4400191f066a8ccb2bd93aeb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

TextOutW
GetTextColor
SetDCBrushColor
BitBlt
GetTextCharset
GetPixel
CreateFontW

user32

LoadImageW
GetWindowTextW
CreateDialogParamW
CreateMenu
DialogBoxParamW
EndDialog
GetClassNameW
GetDlgItemTextW
GetKeyNameTextW
GetMessageW

kernel32

LoadLibraryW
LoadLibraryExA
GetLastError
GetDateFormatW
FormatMessageW

Exports

Exports

del
gdel
gdll
gmod
pmod
sdll
wdll

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LBB_Rundll32_pass.dll
.dll windows:5 windows x86 arch:x86

Password: infected

a6e537c4400191f066a8ccb2bd93aeb1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

gdi32

TextOutW
GetTextColor
SetDCBrushColor
BitBlt
GetTextCharset
GetPixel
CreateFontW

user32

LoadImageW
GetWindowTextW
CreateDialogParamW
CreateMenu
DialogBoxParamW
EndDialog
GetClassNameW
GetDlgItemTextW
GetKeyNameTextW
GetMessageW

kernel32

LoadLibraryW
LoadLibraryExA
GetLastError
GetDateFormatW
FormatMessageW

Exports

Exports

del
gdel
gdll
gmod
pmod
sdll
wdll

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
LBB_pass.exe
.exe windows:5 windows x86 arch:x86

Password: infected

3bc510de773c954bd69d33670cb624d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetPixel
GetPixel
GetTextColor
SelectPalette
SelectObject
GetTextMetricsW
TextOutW
GetTextCharset
CreateSolidBrush
CreateFontW
SetTextColor
CreateDIBitmap

user32

LoadImageW
GetClassNameW
DialogBoxParamW
CreateDialogParamW

kernel32

GetCommandLineA
GetAtomNameW
LoadLibraryW
GetFileAttributesW

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Password_dll.txt
Password_exe.txt
Password_ps1.txt
Builds/LBG_vx-_____________FC8E43EC21BE9047_19.12.24_hacking_is_illegal_ok.zip
.zip

Password: infected
FC8E43EC21BE9047/lbg32.exe
.exe windows:0 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.data
Size: - Virtual size: 740KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 59KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
FC8E43EC21BE9047/lbg64.exe
.exe windows:0 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.data
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 48KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Builds/LBL_vx-_____________1007BF65F80311D2_19.12.24_hacking_is_illegal_and_for_nerds.zip
.zip

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

Password: infected

3bc510de773c954bd69d33670cb624d6

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

kernel32

Sections

.text Size: 102KB - Virtual size: 102KB

.itext Size: 1KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 40KB - Virtual size: 43KB

.pdata Size: 9KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 4KB

Password: infected

bfce782cfa0e2f22c598571118d3f91d

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

kernel32

Sections

.text Size: 75KB - Virtual size: 74KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 23KB - Virtual size: 24KB

.pdata Size: 9KB - Virtual size: 9KB

.reloc Size: 3KB - Virtual size: 2KB

Password: infected

a6e537c4400191f066a8ccb2bd93aeb1

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

kernel32

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.itext Size: 2KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 40KB - Virtual size: 43KB

.pdata Size: 9KB - Virtual size: 9KB

.reloc Size: 4KB - Virtual size: 4KB

Password: infected

a6e537c4400191f066a8ccb2bd93aeb1

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

kernel32

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.itext Size: 2KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 40KB - Virtual size: 43KB

.pdata Size: 9KB - Virtual size: 9KB

Password: infected

3bc510de773c954bd69d33670cb624d6

Headers

DLL Characteristics

File Characteristics

.text
Size: 102KB - Virtual size: 102KB

.itext
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 40KB - Virtual size: 43KB

.pdata
Size: 9KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 75KB - Virtual size: 74KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 23KB - Virtual size: 24KB

.pdata
Size: 9KB - Virtual size: 9KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 100KB - Virtual size: 99KB

.itext
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 40KB - Virtual size: 43KB

.pdata
Size: 9KB - Virtual size: 9KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 100KB - Virtual size: 99KB

.itext
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 40KB - Virtual size: 43KB

.pdata
Size: 9KB - Virtual size: 9KB

.text
Size: 102KB - Virtual size: 102KB

.itext
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 40KB - Virtual size: 43KB

.pdata
Size: 9KB - Virtual size: 9KB

.data
Size: - Virtual size: 740KB

.text
Size: 59KB - Virtual size: 60KB

.rdata
Size: 512B - Virtual size: 4KB

.data
Size: - Virtual size: 1.1MB

.text
Size: 48KB - Virtual size: 52KB

.rdata
Size: 512B - Virtual size: 4KB