Lockbit3.Builder.Malware.rar
- SHA256 73361db30960d95bf9e4ad4ea2f0585fd4d3e81fa9b5d5e8441f84947e610748
Password
123
Overview
overview
10Static
static
10Lockbit3.B...re.rar
windows7-x64
Lockbit3.B...re.rar
windows10-2004-x64
Lockbit3.B...re.rar
android-9-x86
Lockbit3.B...re.rar
android-13-x64
Lockbit3.B...re.rar
macos-10.15-amd64
Lockbit3.B...re.rar
ubuntu-18.04-amd64
Lockbit3.B...re.rar
debian-9-armhf
Lockbit3.B...re.rar
debian-9-mips
Lockbit3.B...re.rar
debian-9-mipsel
Lockbit 3 ...ld.bat
windows7-x64
1Lockbit 3 ...ld.bat
windows10-2004-x64
1Lockbit 3 ...ld.bat
android-13-x64
Lockbit 3 ...ld.bat
android-13-x64
Lockbit 3 ...ld.bat
macos-10.15-amd64
Lockbit 3 ...ld.bat
ubuntu-18.04-amd64
Lockbit 3 ...ld.bat
debian-9-armhf
Lockbit 3 ...ld.bat
debian-9-mips
Lockbit 3 ...ld.bat
debian-9-mipsel
Lockbit 3 ...er.exe
windows7-x64
1Lockbit 3 ...er.exe
windows10-2004-x64
3Lockbit 3 ...er.exe
android-10-x64
Lockbit 3 ...er.exe
android-13-x64
Lockbit 3 ...er.exe
macos-10.15-amd64
Lockbit 3 ...er.exe
ubuntu-18.04-amd64
Lockbit 3 ...er.exe
debian-9-armhf
Lockbit 3 ...er.exe
debian-9-mips
Lockbit 3 ...er.exe
debian-9-mipsel
Lockbit 3 ...g.json
windows7-x64
Lockbit 3 ...g.json
windows10-2004-x64
Lockbit 3 ...g.json
android-13-x64
Lockbit 3 ...g.json
android-13-x64
Lockbit 3 ...g.json
macos-10.15-amd64
Behavioral task
behavioral1
Sample
Lockbit3.Builder.Malware.rar
Resource
win7-20241010-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
Lockbit3.Builder.Malware.rar
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral3
Sample
Lockbit3.Builder.Malware.rar
Resource
android-x86-arm-20240624-en
android-9-x86
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Lockbit3.Builder.Malware.rar
Resource
android-33-x64-arm64-20240624-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
Lockbit3.Builder.Malware.rar
Resource
macos-20241101-en
macos-10.15-amd64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
Lockbit3.Builder.Malware.rar
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
Lockbit3.Builder.Malware.rar
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
Lockbit3.Builder.Malware.rar
Resource
debian9-mipsbe-20240611-en
debian-9-mips
0 signatures
300 seconds
Behavioral task
behavioral9
Sample
Lockbit3.Builder.Malware.rar
Resource
debian9-mipsel-20240729-en
debian-9-mipsel
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
Lockbit 3 Builder/Build.bat
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral11
Sample
Lockbit 3 Builder/Build.bat
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
Lockbit 3 Builder/Build.bat
Resource
android-33-x64-arm64-20240624-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral13
Sample
Lockbit 3 Builder/Build.bat
Resource
android-33-x64-arm64-20240910-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral14
Sample
Lockbit 3 Builder/Build.bat
Resource
macos-20241106-en
macos-10.15-amd64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
Lockbit 3 Builder/Build.bat
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
300 seconds
Behavioral task
behavioral16
Sample
Lockbit 3 Builder/Build.bat
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
300 seconds
Behavioral task
behavioral17
Sample
Lockbit 3 Builder/Build.bat
Resource
debian9-mipsbe-20240729-en
debian-9-mips
0 signatures
300 seconds
Behavioral task
behavioral18
Sample
Lockbit 3 Builder/Build.bat
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
Lockbit 3 Builder/builder.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
Lockbit 3 Builder/builder.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral21
Sample
Lockbit 3 Builder/builder.exe
Resource
android-x64-20240624-en
android-10-x64
0 signatures
300 seconds
Behavioral task
behavioral22
Sample
Lockbit 3 Builder/builder.exe
Resource
android-33-x64-arm64-20240910-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral23
Sample
Lockbit 3 Builder/builder.exe
Resource
macos-20241101-en
macos-10.15-amd64
0 signatures
300 seconds
Behavioral task
behavioral24
Sample
Lockbit 3 Builder/builder.exe
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
0 signatures
300 seconds
Behavioral task
behavioral25
Sample
Lockbit 3 Builder/builder.exe
Resource
debian9-armhf-20240611-en
debian-9-armhf
0 signatures
300 seconds
Behavioral task
behavioral26
Sample
Lockbit 3 Builder/builder.exe
Resource
debian9-mipsbe-20240418-en
debian-9-mips
0 signatures
300 seconds
Behavioral task
behavioral27
Sample
Lockbit 3 Builder/builder.exe
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
0 signatures
300 seconds
Behavioral task
behavioral28
Sample
Lockbit 3 Builder/config.json
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral29
Sample
Lockbit 3 Builder/config.json
Resource
win10v2004-20250129-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral30
Sample
Lockbit 3 Builder/config.json
Resource
android-33-x64-arm64-20240910-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral31
Sample
Lockbit 3 Builder/config.json
Resource
android-33-x64-arm64-20240624-en
android-13-x64
0 signatures
300 seconds
Behavioral task
behavioral32
Sample
Lockbit 3 Builder/config.json
Resource
macos-20241106-en
macos-10.15-amd64
0 signatures
300 seconds
General
- Target Lockbit3.Builder.Malware.rar
- Size 168KB
- Sample250205-m2x7msvmen
- SHA256 73361db30960d95bf9e4ad4ea2f0585fd4d3e81fa9b5d5e8441f84947e610748
- MD5 c9d4d90dfb45736666cb5e1e01c4b29f
- SHA1 edd35479b1d1ebaabd42e0c596cf3596c2078a87
- SHA512 53d04da780ec3af1bf4963de5df07f82d5fa9d77337b0d2d41c809c55c91c0a1547678dc591391abd4525122f3ebd1b85df1533d50c56c325c94e80503af6a04
- SSDEEP 3072:7NYcIVnrfkcvrXFG1o3QQpC1SxQtrN7qsXQZU8ihgd33fG+j3jQfdjEGaN0Wynf0:7AVnjPvh2yQQ8pt2U8ihQ3++j38fd5h8
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
blackmatter
Version
-
65.239
Signatures
- Blackmatter family
- Lockbit family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule static1/unpack001/Lockbit 3 Builder/builder.exe family_lockbit - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Lockbit 3 Builder/builder.exe unpack001/Lockbit 3 Builder/keygen.exe
File Explorer
-
Lockbit3.Builder.Malware.rar.rar 168KB
-
Lockbit 3 Builder/Build.bat741B
-
Lockbit 3 Builder/builder.exe.exe 470KB
-
Lockbit 3 Builder/config.json8KB
-
Lockbit 3 Builder/keygen.exe.exe 31KB
Lockbit 3 Builder/Build.bat
- SHA256 8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
- MD5 4e46e28b2e61643f6af70a8b19e5cb1f
- SHA1 804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
- SHA512 009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b
- MD5 SHA1 SHA512
Lockbit 3 Builder/builder.exe
- IMPHASH d2e26e45dcb84f1062f90f29a9cf0faa
- SHA256 e8e2deb0a83aebb1e2cc14846bc71715343372103f279d2d1622e383fb26d6ef
- MD5 8c689dc9e82c9356b990d2b67b4943e1
- SHA1 6bdc415b9c356bbeaea75c7336cd72910b95a644
- SHA512 fb38a79dbcebde149736d5e1ca37dc15d274838be304d3f86e992d610b50c31d7fe4c30f6697c890f3753443af16eab712aef3f8da88d76ed00790083deb51e4
- SSDEEP 12288:7tDkI5O/1MHOvEIfRfaXNCTL98vy7anEvY86vM1kiY4XotXpEKAoiO5wBmrkAUfM:7tQcOdu4BcCTL98vy7anEvY86vM1kiYt
- MD5 SHA1 SHA512 SSDEEP
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
1
Major OS version
5
Entry point
15780
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
kernel32
LoadResource
WriteFile
CreateFileW
ExitProcess
FindResourceW
GetCommandLineW
GetFileSize
GetModuleHandleW
GlobalFree
SizeofResource
LockResource
ReadFile
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
sprintf
strchr
strcpy
strlen
strstr
wcscat
wcscpy
wcslen
wcsrchr
localeconv
_stricmp
_strcmpi
tolower
realloc
malloc
free
strtod
strncmp
imagehlp
CheckSumMappedFile
ntdll
RtlFreeHeap
RtlAllocateHeap
NtClose
RtlImageNtHeader
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
439KB
Virtual Size
438KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Lockbit 3 Builder/config.json
- SHA256 3f7518d88aefd4b1e0a1d6f9748f9a9960c1271d679600e34f5065d8df8c9dc8
- MD5 a6ba7b662de10b45ebe5b6b7edaa62a9
- SHA1 f3ed67bdaef070cd5a213b89d53c5b8022d6f266
- SHA512 7fc9d4d61742a26def74c7dd86838482e3fc1e4e065cb3a06ae151e2c8614c9c36e8816ae0a3560ad5dd3cc02be131cb232c7deacc7f7b5a611e8eec790feea1
- SSDEEP 192:DLxgpmWU6ig4HJmLDHqlexR4qjIuoIyig4H8mLDHs:D1IhU6ApmZrIoyAcmM
- MD5 SHA1 SHA512 SSDEEP
Lockbit 3 Builder/keygen.exe
- IMPHASH 73eeda700d0a0376845c61c44155f4a8
- SHA256 bb76f4d10ec2c1d24be904d2ee078f34a6b5bd11f3b40f295e116fea44824b89
- MD5 5e28c7c900e4dce08366051c22f07f84
- SHA1 ec03fd1551d31486e2f925d9c2db3b87ffcd7018
- SHA512 fb45d7466d8a979ca78202be20175585e8d560a4cfcc81d3ef15edeb2d292cb5a05cdb93718cef685f1c8ee94cabf6c35ff010785d774057d045ba7b8a478a1e
- SSDEEP 768:F6+T41GjHbdWCWDwDD01riWpJxKpAQJs/3JGIDLQH:E+U+hHIBpJxixgQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
1
Major OS version
5
Entry point
5526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
wsprintfA
kernel32
GetCurrentDirectoryW
WriteFile
CloseHandle
CreateFileW
ExitProcess
GetCommandLineW
GlobalFree
SetCurrentDirectoryW
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
free
fputc
exit
calloc
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE