lockbit | brain[.]exe[.]zip

General

Target
brain.exe.zip
Size 97KB
Sample250226-2epdjsvygx
SHA256 da2c61b069db32058791304408c57922263cedaaaf28230fe787b63be71d5d5f
MD5 877b0a047ecbea4042ddf9948b687e6c
SHA1 2a30222a552d2e2de861a94fc2173eaaa7cf43e6
SHA512 68dcd9814178a2cc44410528594a77627899124acac74ab835fda6f4ba830f12fd32b2e5073a1b8616591cd3a62799dd88444385a644682bfe4ff23faaee54c4
SSDEEP 1536:Ptz6P6mq+dgX2ymOQKFJRX9ij3aOR64eU7TCTMlI3bac8AvxsLcJj4VdbeQx:FJ6dA2bAH9SKOR6lmTPlI5YAJKdeI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/brain.exe.bin	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/brain.exe.bin

File Explorer

brain.exe.zip

.zip 97KB
brain.exe.bin

.exe 147KB

brain.exe.zip

SHA256 da2c61b069db32058791304408c57922263cedaaaf28230fe787b63be71d5d5f
MD5 877b0a047ecbea4042ddf9948b687e6c
SHA1 2a30222a552d2e2de861a94fc2173eaaa7cf43e6
SHA512 68dcd9814178a2cc44410528594a77627899124acac74ab835fda6f4ba830f12fd32b2e5073a1b8616591cd3a62799dd88444385a644682bfe4ff23faaee54c4
SSDEEP 1536:Ptz6P6mq+dgX2ymOQKFJRX9ij3aOR64eU7TCTMlI3bac8AvxsLcJj4VdbeQx:FJ6dA2bAH9SKOR6lmTPlI5YAJKdeI
MD5 SHA1 SHA512 SSDEEP

Password

infected

brain.exe.bin

IMPHASH 41fb8cb2943df6de998b35a9d28668e8
SHA256 eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12
MD5 448f1796fe8de02194b21c0715e0a5f6
SHA1 935c0b39837319fda571aa800b67d997b79c3198
SHA512 0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831
SSDEEP 3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

brain.exe.zip

brain.exe.bin

gdi32

user32

kernel32

generic

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

brain.exe.zip

brain.exe.bin

gdi32

user32

kernel32

generic