UXLocker Builder(1).zip
- SHA256 045a4422f12fe0dd4b1e2f6ac0859a818727c2836d2f0235086a129e48c5a271
Overview
overview
10Static
static
3Locker/Loc...er.exe
windows10-2004-x64
3Locker/Loc...er.exe
windows11-ltsc_2024-x64
3Locker/Loc...er.pdb
windows10-2004-x64
3Locker/Loc...er.pdb
windows11-ltsc_2024-x64
3Locker/Met...rk.dll
windows10-2004-x64
1Locker/Met...rk.dll
windows11-ltsc_2024-x64
1Locker/Stub/Stub.exe
windows10-2004-x64
10Locker/Stub/Stub.exe
windows11-ltsc_2024-x64
6Locker/dnlib.dll
windows10-2004-x64
1Locker/dnlib.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Locker/LockerBuilder.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Locker/LockerBuilder.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Locker/LockerBuilder.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Locker/LockerBuilder.pdb
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
Locker/MetroFramework.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Locker/MetroFramework.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Locker/Stub/Stub.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral8
Sample
Locker/Stub/Stub.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
Locker/dnlib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Locker/dnlib.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target UXLocker Builder(1).zip
- Size 824KB
- Sample260908-m16gmaydrb
- SHA256 045a4422f12fe0dd4b1e2f6ac0859a818727c2836d2f0235086a129e48c5a271
- MD5 a764f863ce4fa80713242b99d911a498
- SHA1 b86fc6748e87bc8666a14b18e2e83d175a4da655
- SHA512 c760c038a92873ba1690e7507e916fddca0570866e93b11ac2fd33a873f8ffa1afd24da3dbdcc898e080aa821d143b1bfa28771fdc505b6bbba0a5510d8785fd
- SSDEEP 12288:ycAAIPhciMQUYmhlmzGZcJWIFvpJ8SUibQfGtwCCC5+8jSRlglnbS/hDp7D7XW6C:yXZMQUFlXUvH8SEWVCVp4SJuxx
- TLSH T14605333BA8447922FD624A65ECEC4AF38CC6DF0F82CA9527DA01854D6067B11CD4BFD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Locker/LockerBuilder.exe unpack001/Locker/MetroFramework.dll unpack001/Locker/Stub/Stub.exe unpack001/Locker/dnlib.dll
File Explorer
-
UXLocker Builder(1).zip.zip 824KB
-
Locker/LockerBuilder.exe.exe 18KB
-
Locker/LockerBuilder.exe.config.xml 176B
-
Locker/LockerBuilder.pdb5KB
-
Locker/MetroFramework.dll.dll 149KB
-
Locker/Sounder/sound.wav407KB
-
Locker/Stub/Stub.exe.exe 215KB
-
Locker/dnlib.dll.dll 1.1MB
-
Locker/dnlib.xml.xml 1.8MB
Locker/LockerBuilder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 27d65185cf27e2085909ef73411e66888b864be7e32b2afab4506de677dcb614
- MD5 d756b6331d0f00c1fa86bfaddbab180e
- SHA1 fa5a1f2fb437d8c0dc45ca462df711dd78e3f774
- SHA512 38624d9f1b0df6de25714a6500985bfc705ffa87eb695cedcd9082642d91408368b26d5e15ebe9c29f80e3d02df0053f6075d2a2e2012ce9fab64a541fecbdfd
- SSDEEP 384:8z+S+UByAqwBg/MpUg+q7JPwyeE7T5oHvXqxVsiJ:8z+h2W+oHvHS
- TLSH T12B82F80AAA7CC7AAD4B4D7F42DB2188103F277261242DA5E6ECB24CE59777640B01753
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23834
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\prida\OneDrive\Desktop\bluelockersrc\bluelocksrc\obj\Debug\net472\LockerBuilder.pdb
mscoree
_CorExeMain
Name
.text
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Locker/LockerBuilder.exe.config
- SHA256 ad8267122c40d37dcd9d99e1412d763187a1825732f378db8867f3ecf675cf70
- MD5 21fa0b1d75c0cc7369f1e735fe90c7a9
- SHA1 e2d01a1b6aa66e5d3ed575aca79560b014bbfefe
- SHA512 60f6704cd1b3035a1a3403ee3870c7cbc13d6e601172745336ebbffa2ee3dc21785702470ab006c69dbbde0d5525625bb25ade5c641c80c8165fbc46fdad2ad0
- TLSH T1D8C080154098BD274D334F176351C525EBB072526464040CF42F9657073104D4247326
- MD5 SHA1 SHA512 TLSH
Locker/LockerBuilder.pdb
- SHA256 eb64c7bebe3082bb715758b8afb73f80fe9eed7716ec4e77683f19dde95703e4
- MD5 f0932050f215619e31a3b5be50c266e1
- SHA1 37e39bdbfe38f3e7a754bf71d2d60f8cb96987e1
- SHA512 0057a26f12ab4a6c2677239bbd532e2e69308931b0c4a89b744c47fa4ef0c324c55b4032999b2ffb990c30097dd9140156a1e63229fa7b2820a50cebb88255e0
- SSDEEP 96:g8zVmB5JM+7gvBZjhPkDvCEMXLCMxUZVHEiRpNrf2IVJxme:/O5JM+7uthPkDvOXLCt/7z2Ioe
- TLSH T145B1D81BF3105915DE4325756436634AD370D0B9E2049FE5A3C45B6CEDC53CBAEB22AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Locker/MetroFramework.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 baf326f52d39155d722465947f4cc67e6e90cfd0f89954eab959568e9bc342aa
- MD5 44538b311e9ec2bcf0a6452702628d99
- SHA1 da67301539903775708e9ec913654851e9e8eade
- SHA512 b65e3bc1c0f7b4c8f778cf52a36d628301d60aab53fdaf0355163e4865bc3d3adbf8870bb6cefc604708fdf2c0e72258eaf2fe301d524af2f77bc08014c9610a
- SSDEEP 3072:LU0T+erz8jYxYg5lzrPHlMUzxXd4kRZPI9q:vT+erz8jYxYgv/lxXGWPS
- TLSH T139E33B21770D457FC6BF4A7AF0A12492C3B0DC51FA7BDF5D5C82A29C989B794AE01283
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
157918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
146KB
Virtual Size
146KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Locker/Sounder/sound.wav
- SHA256 316dcdf28cc545bc32554b2d93d7505b3a6c570fb8b93cb172876ec65e250c27
- MD5 df5ddac16cfca4dc22db3e3d756cc595
- SHA1 615d29a354de284d65f439d328c50c82e8dd7a91
- SHA512 de251c5a7e4efb4a429db7da469ed167dafe644cd39c40f1881b79b4ce7be9f9ca395f3765bf5cb3d120e62aabc888e38b1880adb28f51581e2b7142856859ca
- SSDEEP 768:6diCI3RoVMwMHvR2g2w4KKOsgsl832uEA/LTOfs9G9BkC7yTAg9akcTLV4vos7ND:ZTAg91WeousY53DlpqoWVys86ZRD9
- TLSH T1E994C0957782FC01C416B4BE558ED6E95737BF844B05A22374A2B7BF2F68A400CCE6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Locker/Stub/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 19b6c1905f4435815f6d79b7eb0aee50ccc6d4ccde4dca9b973e3589e15fc00d
- MD5 f92e29949ab567932169f73da6291cca
- SHA1 1b44771253389ab095ef5a356245e743d627a0c6
- SHA512 c57eed984bd716de5f2889c68b776e11673b57f7f03513b40e3285ae5f3fc487ad4f672e99b7539bb514448643d2a07f7e40693d1b9401b8345f84f05539f891
- SSDEEP 3072:XJLxqB76ZepgiHpOGYGKk7YC/mxvWvbXa9XNExSCpMW90KImQijndBbY6cSeq2nV:px5GXuXcSCpMW90KImQijnfb6nRtjU
- TLSH T183245BD826964D7AC87E53BE9191214603F8E016D603E78CEBE9B4F47D63B21CB05B4B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
225174
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\prida\OneDrive\Desktop\bluelockersrc\stubsrc\obj\Debug\net40\Stub.pdb
mscoree
_CorExeMain
Name
.text
Size
212KB
Virtual Size
212KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Locker/dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 97ef5328d1d1703924c48d9cd1d45b7227fe3836e116dcded623b6a0dbd52c23
- MD5 c087c70deb98db9d0b046d0a3d0e582a
- SHA1 f195b25b9c2d85006e15dce3b0b22eab6a4d16a9
- SHA512 9a1c40ef39ea5cb28ace6ba069b1afbf55ca47e4189b06d3cd033cbf7d01a838e7b5edb0e8578547a219a312446a5c2daa68e784ba2fb5c1c799dcc4500ab24c
- SSDEEP 24576:ct140a1plV+Th8rQ7F/qy0EFXnh8MviJa319Iv7f1NGgV:LIwy
- TLSH T12B456C1137FD9B77E06F873AE835061903F1D406A697EF4F6A54ABAA6C833685C00397
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1183806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Locker/dnlib.xml
- SHA256 2c4e2806188d354cbf7bf81bbc3963eb465d10dcbac8a75690b219886d164416
- MD5 d5bc999b9d5cbc01e803f406952c21ff
- SHA1 645a318570c531c5470b3e114b53d74f21d783aa
- SHA512 5245c5e5e098ae915209c97a41724fbc9c849e2ec339f3517190edf4556660534a081c249b57ad145c164526c59b381a1cc69b7a95a0b529acf2d3c03c9713f7
- SSDEEP 6144:VTA+HpSCIPAqPFgrOLkOXhR+y+cNUaOtCW5n:dpSCIPAqPFgrO7XhR+y+cNUaOtCW5n
- TLSH T150857714B6C2AD121C36525B9E64FCC4FE550C33604A2E19B68D2F535F7ADCBE2AF920
- MD5 SHA1 SHA512 SSDEEP TLSH