LockBit-main.zip
- SHA256 707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881
Behavioral task
behavioral1
Sample
LockBit-main.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
LockBit-main/Build.bat
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral3
Sample
LockBit-main/README.vbs
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
LockBit-main/builder.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
Behavioral task
behavioral5
Sample
LockBit-main/config.json
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral6
Sample
LockBit-main/keygen.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
600 seconds
General
- Target LockBit-main.zip
- Size 292KB
- Sample260620-sd947afw4l
- SHA256 707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881
- MD5 68309717a780fd8b4d1a1680874d3e12
- SHA1 4cfe4f5bbd98fa7e966184e647910d675cdbda43
- SHA512 e16de0338b1e1487803d37da66d16bc2f2644138615cbce648ae355f088912a04d1ce128a44797ff8c4dfc53c998058432052746c98c687670e4100194013149
- SSDEEP 6144:n42LBVCsV+PkMeW9zTiY/NaQmHst5ySPzmcfIMwmafvR:n4EzwkMeWgY1NmyESPB1/aXR
- TLSH T1CF54230B4E35C9CDFB6CABB3556898E49DB7CAF3BC4B1D49F05193B0A25E9082602E14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
blackmatter
Version
-
25.239
Signatures
- Family: BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule static1/unpack001/LockBit-main/builder.exe family_lockbit - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/LockBit-main/builder.exe unpack001/LockBit-main/keygen.exe
File Explorer
-
LockBit-main.zip.zip 292KB
-
LockBit-main/Build.bat1KB
-
LockBit-main/README.md.vbs 4KB
-
LockBit-main/builder.exe.exe 469KB
-
LockBit-main/config.json8KB
-
LockBit-main/keygen.exe.exe 31KB
LockBit-main/Build.bat
- SHA256 95df1d82137315708931f1fc3411e891cd42d1cab413d4380b479788729248ed
- MD5 b8f24efd1d30aac9d360db90c8717aee
- SHA1 7d31372560f81ea24db57bb18d56143251a8b266
- SHA512 14ebf7905f15983593164d1c093bb99d098daf3963f1b7a913c1a9763acb950075a0d2cceab3558cce3e7269c2a2d5dacc2b3c6c55807b0b6bda6bfad62dd032
- TLSH T1E9212872E045293740AD8C41E9F9DBD0AF776AD78642044ED12AA23D5722061637E6AF
- MD5 SHA1 SHA512 TLSH
LockBit-main/README.md
- SHA256 64312260bf9f040c92ece170d05250526f138f059760b8a5b9023d6d38e71db1
- MD5 dc8d96087e0094c3cc793b3445bef8de
- SHA1 8bf22f847b778daeccf43468516e775bcda2802c
- SHA512 f939d6a2b9a957a5c0c45beda2e0103a84bc907e2fef0b747c91144b23c5663de388d3076fced1a5a696bb45e7314fd86f19f8fdd668d0d1aac3947290276c2e
- SSDEEP 96:IWz58QWqTMNWLWqN+LloWRWKWl2xRTWQ2Wbl6LTkP0W2WCePW1z0WXh0CjViC8AS:IWz58QWqWWLWqqyWRWKWMtWxWb4S0Wxt
- TLSH T1A181B51FB3191772079642D6755A23EAFB2BE49D3363CA2D586DC00C338586C833A6F9
- MD5 SHA1 SHA512 SSDEEP TLSH
LockBit-main/builder.exe
- IMPHASH d2e26e45dcb84f1062f90f29a9cf0faa
- SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
- MD5 c2bc344f6dde0573ea9acdfb6698bf4c
- SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
- SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0
- SSDEEP 12288:CzVXpdg/1MB94JD7RfaVT1hG98P67PNV3giFH6J1VjR3L6dpbQrQyEpInmwuRUfB:CzxjgdRpBq1hG98P67PNV3giFH6J1Vjn
- TLSH T10EA48D11B225D073D07714F67B6BB129B3AF4D3C0A796803EAD41F0938B59A3AF11A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15780
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
kernel32
LoadResource
WriteFile
CreateFileW
ExitProcess
FindResourceW
GetCommandLineW
GetFileSize
GetModuleHandleW
GlobalFree
SizeofResource
LockResource
ReadFile
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
sprintf
strchr
strcpy
strlen
strstr
wcscat
wcscpy
wcslen
wcsrchr
localeconv
_stricmp
_strcmpi
tolower
realloc
malloc
free
strtod
strncmp
imagehlp
CheckSumMappedFile
ntdll
RtlFreeHeap
RtlAllocateHeap
NtClose
RtlImageNtHeader
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
438KB
Virtual Size
438KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LockBit-main/config.json
- SHA256 d121f4293160e0a39cbb184c032cd45baf1372db00cd33afb0e166ac0a60ac4c
- MD5 de177fa08e9b2eaa378760afd53be6b2
- SHA1 a18050f9e5f2412955df4b868ffb866209d2b84a
- SHA512 44f4e745013eaa7d95486c91457c23fd9694f859920766f0139cf5ca9c84ff6c82d59be9675dd1a0c7b3216464c85cf732dbbdb0e641a5e47cbbf1830f4a0a8c
- SSDEEP 192:4m26pOWU6ig4HJmLDHqlexR4LjIuoIyig4H8mLDHU:4ba5U6ApmZ+IoyAcm0
- TLSH T17902B26CDE3D2C3985C07C81ABDBBDA3E2B7619744C41A09B858C62D4F0DF1B61A67E4
- MD5 SHA1 SHA512 SSDEEP TLSH
LockBit-main/keygen.exe
- IMPHASH 73eeda700d0a0376845c61c44155f4a8
- SHA256 ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37
- MD5 71c3b2f765b04d0b7ea0328f6ce0c4e2
- SHA1 bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4
- SHA512 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035
- SSDEEP 768:A6+T41GjHbdWCWDwDD01riWpJxKpAQJs/3JGIDLQ5:b+U+hHIBpJxixgQ
- TLSH T1A2E2F6439695B8B7D47693B2322BC6FD8DF10D16026F667B0B3FF8701932C429B24699
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
wsprintfA
kernel32
GetCurrentDirectoryW
WriteFile
CloseHandle
CreateFileW
ExitProcess
GetCommandLineW
GlobalFree
SetCurrentDirectoryW
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
free
fputc
exit
calloc
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE