lockbit | Loader[.]zip

General

Target
Loader.zip
Size 94KB
Sample250309-rd6lbssm19
SHA256 5f227a96e12db3cb3d4f39028e7ee99526e7704301e25bb77fedf478a99f2739
MD5 80b8e03154e531ae22cdad9da43637c5
SHA1 91d49e2bdf53f41502c3879144c1bd8930ae9ff4
SHA512 6e2db772ac752a0c8bfcd4a95f9c15261d668d548c29f351ab67502b54d9b06c7299e9badb3560d018f1e1d886fa7ac85c388c787f5df3ea98858c8a69fbf1cb
SSDEEP 1536:GrMMFx7IZJRbbMvODx4aQybep5UR/yxe1Baiws7LToj+DRqGMyhQEtftnMUa7vqT:wbx7IJMvQ4aFbesdyxaXX1DRn5MUabqT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lockbit

Malware Config

Signatures

Lockbit family
lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs

resource	yara_rule
static1/unpack001/Loader 3.0.exe	family_lockbit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Loader 3.0.exe

File Explorer

Loader.zip

.zip 94KB
Loader 3.0.exe

.exe 147KB

Loader.zip

SHA256 5f227a96e12db3cb3d4f39028e7ee99526e7704301e25bb77fedf478a99f2739
MD5 80b8e03154e531ae22cdad9da43637c5
SHA1 91d49e2bdf53f41502c3879144c1bd8930ae9ff4
SHA512 6e2db772ac752a0c8bfcd4a95f9c15261d668d548c29f351ab67502b54d9b06c7299e9badb3560d018f1e1d886fa7ac85c388c787f5df3ea98858c8a69fbf1cb
SSDEEP 1536:GrMMFx7IZJRbbMvODx4aQybep5UR/yxe1Baiws7LToj+DRqGMyhQEtftnMUa7vqT:wbx7IJMvQ4aFbesdyxaXX1DRn5MUabqT
MD5 SHA1 SHA512 SSDEEP

Loader 3.0.exe

IMPHASH 914685b69f2ac2ff61b6b0f1883a054d
SHA256 6dd7522accb6773bade16720b53ca577574defae5b1c7caf4b7fc6826dfed7e7
MD5 ff4cd364323fc2048c35783a38070aef
SHA1 4736172dd07a3a196343b94dd56b4e4edc0f2bce
SHA512 c72b07b78ccbcfad14fa9f7bc3e8a086c29969b4f7f30dbe57a1a173cd82d61a20bf5ead0bc7b627d5d7f7f0def71710e2ce09590be7a886ad6c9414981eb961
SSDEEP 1536:FzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDEtDyI4njdbJBGCkmsQwvB6jr4j:GqJogYkcSNm9V7Dk4F91qYUrnbT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

103535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Loader.zip

Loader 3.0.exe

gdi32

user32

kernel32

generic

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Loader.zip

Loader 3.0.exe

gdi32

user32

kernel32

generic