Lockbit 3 Builder.7z
- SHA256 b2c3beda4b000a3d9af0a457d6d942ec81696f3ed485f7cf723b18008a5f3d10
Password
infected
Behavioral task
behavioral1
Sample
LBLeak/Build.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
LBLeak/Build.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
LBLeak/builder.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
LBLeak/builder.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
LBLeak/keygen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
LBLeak/keygen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Lockbit 3 Builder.7z
- Size 139KB
- Sample261002-kbe72astes
- SHA256 b2c3beda4b000a3d9af0a457d6d942ec81696f3ed485f7cf723b18008a5f3d10
- MD5 c9c2f3805f0012628e9d62e8f75af4dd
- SHA1 b6269b1fc8813b93c11ec6066dc33d9f99f2e431
- SHA512 ed4cb425807bbef4da92fe9e17b78746e096612e6006521279162379b2fc65f8dec7647e9c5403c6a74e6eb9b61dce7ca1c74c65d77aafbd0719be79cb1d70ff
- SSDEEP 3072:pYWJsCuSlRODbWhyyZZsZ77n4s31uZzd2ppyMPOLOcrgCz:pbuSlicZyx4W1uLYpyMPOLjhz
- TLSH T1BED312B481835891CB38CDF241A94276620FA331F7B66951D98CF9507C6B1912D3BEDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
blackmatter
Version
-
65.239
Signatures
- Family: BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule static1/unpack001/LBLeak/builder.exe family_lockbit - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/LBLeak/builder.exe unpack001/LBLeak/keygen.exe
File Explorer
-
Lockbit 3 Builder.7z.7z 139KB
-
LBLeak/Build.bat741B
-
LBLeak/builder.exe.exe 470KB
-
LBLeak/config.json8KB
-
LBLeak/keygen.exe.exe 31KB
LBLeak/Build.bat
- SHA256 8e83a1727696ced618289f79674b97305d88beeeabf46bd25fc77ac53c1ae339
- MD5 4e46e28b2e61643f6af70a8b19e5cb1f
- SHA1 804a1d0c4a280b18e778e4b97f85562fa6d5a4e6
- SHA512 009b17b515ff0ea612e54d8751eef07f1e2b54db07e6cd69a95e7adf775f3c79a0ea91bff2fe593f2314807fdc00c75d80f1807b7dbe90f0fcf94607e675047b
- TLSH T19001E173C48A3873585A9C24E5F5DB25DFFF3BC69A43904ED118632D822602156362EF
- MD5 SHA1 SHA512 TLSH
LBLeak/builder.exe
- IMPHASH d2e26e45dcb84f1062f90f29a9cf0faa
- SHA256 e8e2deb0a83aebb1e2cc14846bc71715343372103f279d2d1622e383fb26d6ef
- MD5 8c689dc9e82c9356b990d2b67b4943e1
- SHA1 6bdc415b9c356bbeaea75c7336cd72910b95a644
- SHA512 fb38a79dbcebde149736d5e1ca37dc15d274838be304d3f86e992d610b50c31d7fe4c30f6697c890f3753443af16eab712aef3f8da88d76ed00790083deb51e4
- SSDEEP 12288:7tDkI5O/1MHOvEIfRfaXNCTL98vy7anEvY86vM1kiY4XotXpEKAoiO5wBmrkAUfM:7tQcOdu4BcCTL98vy7anEvY86vM1kiYt
- TLSH T121A47D11B262D073D47729F52B6BA171B36F5D3C1A795807EAEC1F0D28B5823AF10A53
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
15780
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
kernel32
LoadResource
WriteFile
CreateFileW
ExitProcess
FindResourceW
GetCommandLineW
GetFileSize
GetModuleHandleW
GlobalFree
SizeofResource
LockResource
ReadFile
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
sprintf
strchr
strcpy
strlen
strstr
wcscat
wcscpy
wcslen
wcsrchr
localeconv
_stricmp
_strcmpi
tolower
realloc
malloc
free
strtod
strncmp
imagehlp
CheckSumMappedFile
ntdll
RtlFreeHeap
RtlAllocateHeap
NtClose
RtlImageNtHeader
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
439KB
Virtual Size
438KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LBLeak/config.json
- SHA256 3f7518d88aefd4b1e0a1d6f9748f9a9960c1271d679600e34f5065d8df8c9dc8
- MD5 a6ba7b662de10b45ebe5b6b7edaa62a9
- SHA1 f3ed67bdaef070cd5a213b89d53c5b8022d6f266
- SHA512 7fc9d4d61742a26def74c7dd86838482e3fc1e4e065cb3a06ae151e2c8614c9c36e8816ae0a3560ad5dd3cc02be131cb232c7deacc7f7b5a611e8eec790feea1
- SSDEEP 192:DLxgpmWU6ig4HJmLDHqlexR4qjIuoIyig4H8mLDHs:D1IhU6ApmZrIoyAcmM
- TLSH T18C02945CDE392C3989D07C816BD7BDA3E3B7629740C4090AB8B8D62D4F2DF1361927A5
- MD5 SHA1 SHA512 SSDEEP TLSH
LBLeak/keygen.exe
- IMPHASH 73eeda700d0a0376845c61c44155f4a8
- SHA256 bb76f4d10ec2c1d24be904d2ee078f34a6b5bd11f3b40f295e116fea44824b89
- MD5 5e28c7c900e4dce08366051c22f07f84
- SHA1 ec03fd1551d31486e2f925d9c2db3b87ffcd7018
- SHA512 fb45d7466d8a979ca78202be20175585e8d560a4cfcc81d3ef15edeb2d292cb5a05cdb93718cef685f1c8ee94cabf6c35ff010785d774057d045ba7b8a478a1e
- SSDEEP 768:F6+T41GjHbdWCWDwDD01riWpJxKpAQJs/3JGIDLQH:E+U+hHIBpJxixgQ
- TLSH T178E206439695B8B3D47693B2326BC6FD8DF10D16026F667B0B3FF8701932C429B24699
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
1
Major OS version
5
Entry point
5526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
wsprintfA
kernel32
GetCurrentDirectoryW
WriteFile
CloseHandle
CreateFileW
ExitProcess
GetCommandLineW
GlobalFree
SetCurrentDirectoryW
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
free
fputc
exit
calloc
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE