lockbit | LockBit-main[.]zip

resource	yara_rule
static1/unpack001/LockBit-main/builder.exe	family_lockbit

resource
unpack001/LockBit-main/builder.exe
unpack001/LockBit-main/keygen.exe

LockBit-main.zip

SHA256 707bb3b958fbf4728d8a39b043e8df083e0fce1178dac60c0d984604ec23c881
MD5 68309717a780fd8b4d1a1680874d3e12
SHA1 4cfe4f5bbd98fa7e966184e647910d675cdbda43
SHA512 e16de0338b1e1487803d37da66d16bc2f2644138615cbce648ae355f088912a04d1ce128a44797ff8c4dfc53c998058432052746c98c687670e4100194013149
SSDEEP 6144:n42LBVCsV+PkMeW9zTiY/NaQmHst5ySPzmcfIMwmafvR:n4EzwkMeWgY1NmyESPB1/aXR
TLSH
T1CF54230B4E35C9CDFB6CABB3556898E49DB7CAF3BC4B1D49F05193B0A25E9082602E14
MD5 SHA1 SHA512 SSDEEP TLSH

LockBit-main/Build.bat

SHA256 95df1d82137315708931f1fc3411e891cd42d1cab413d4380b479788729248ed
MD5 b8f24efd1d30aac9d360db90c8717aee
SHA1 7d31372560f81ea24db57bb18d56143251a8b266
SHA512 14ebf7905f15983593164d1c093bb99d098daf3963f1b7a913c1a9763acb950075a0d2cceab3558cce3e7269c2a2d5dacc2b3c6c55807b0b6bda6bfad62dd032
TLSH
T1E9212872E045293740AD8C41E9F9DBD0AF776AD78642044ED12AA23D5722061637E6AF
MD5 SHA1 SHA512 TLSH

LockBit-main/README.md

SHA256 64312260bf9f040c92ece170d05250526f138f059760b8a5b9023d6d38e71db1
MD5 dc8d96087e0094c3cc793b3445bef8de
SHA1 8bf22f847b778daeccf43468516e775bcda2802c
SHA512 f939d6a2b9a957a5c0c45beda2e0103a84bc907e2fef0b747c91144b23c5663de388d3076fced1a5a696bb45e7314fd86f19f8fdd668d0d1aac3947290276c2e
SSDEEP 96:IWz58QWqTMNWLWqN+LloWRWKWl2xRTWQ2Wbl6LTkP0W2WCePW1z0WXh0CjViC8AS:IWz58QWqWWLWqqyWRWKWMtWxWb4S0Wxt
TLSH
T1A181B51FB3191772079642D6755A23EAFB2BE49D3363CA2D586DC00C338586C833A6F9
MD5 SHA1 SHA512 SSDEEP TLSH

LockBit-main/builder.exe

IMPHASH d2e26e45dcb84f1062f90f29a9cf0faa
SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
MD5 c2bc344f6dde0573ea9acdfb6698bf4c
SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0
SSDEEP 12288:CzVXpdg/1MB94JD7RfaVT1hG98P67PNV3giFH6J1VjR3L6dpbQrQyEpInmwuRUfB:CzxjgdRpBq1hG98P67PNV3giFH6J1Vjn
TLSH
T10EA48D11B225D073D07714F67B6BB129B3AF4D3C0A796803EAD41F0938B59A3AF11A5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Rule to detect Lockbit 3.0 ransomware Windows payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15780

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

LockBit-main/config.json

SHA256 d121f4293160e0a39cbb184c032cd45baf1372db00cd33afb0e166ac0a60ac4c
MD5 de177fa08e9b2eaa378760afd53be6b2
SHA1 a18050f9e5f2412955df4b868ffb866209d2b84a
SHA512 44f4e745013eaa7d95486c91457c23fd9694f859920766f0139cf5ca9c84ff6c82d59be9675dd1a0c7b3216464c85cf732dbbdb0e641a5e47cbbf1830f4a0a8c
SSDEEP 192:4m26pOWU6ig4HJmLDHqlexR4LjIuoIyig4H8mLDHU:4ba5U6ApmZ+IoyAcm0
TLSH
T17902B26CDE3D2C3985C07C81ABDBBDA3E2B7619744C41A09B858C62D4F0DF1B61A67E4
MD5 SHA1 SHA512 SSDEEP TLSH

LockBit-main/keygen.exe

IMPHASH 73eeda700d0a0376845c61c44155f4a8
SHA256 ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37
MD5 71c3b2f765b04d0b7ea0328f6ce0c4e2
SHA1 bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4
SHA512 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035
SSDEEP 768:A6+T41GjHbdWCWDwDD01riWpJxKpAQJs/3JGIDLQ5:b+U+hHIBpJxixgQ
TLSH
T1A2E2F6439695B8B7D47693B2322BC6FD8DF10D16026F667B0B3FF8701932C429B24699
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

LockBit-main.zip

LockBit-main/Build.bat

LockBit-main/README.md

LockBit-main/builder.exe

user32

kernel32

shell32

msvcrt

imagehlp

ntdll

generic

LockBit-main/config.json

LockBit-main/keygen.exe

user32

kernel32

shell32

msvcrt

generic

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

LockBit-main.zip

LockBit-main/Build.bat

LockBit-main/README.md

LockBit-main/builder.exe

user32

kernel32

shell32

msvcrt

imagehlp

ntdll

generic

LockBit-main/config.json

LockBit-main/keygen.exe

user32

kernel32

shell32

msvcrt

generic