LockBit_LockBit.rar
- SHA256 bc898ce6307318c512fc3ca7650dfc581ff7097953aca026efd994a3882d95f5
Behavioral task
behavioral1
Sample
LockBit/Build.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
LockBit/Build.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
LockBit/builder.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
LockBit/builder.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
LockBit/keygen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral6
Sample
LockBit/keygen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
General
- Target LockBit_LockBit.rar
- Size 158KB
- Sample261111-ned1xsft8k
- SHA256 bc898ce6307318c512fc3ca7650dfc581ff7097953aca026efd994a3882d95f5
- MD5 82e20252256fb046ad55fa6e71503efc
- SHA1 b5413b354ebda4bf0e54e66a5c1cda73bee5a928
- SHA512 18c2404cb3bcff6156ac705d2b95c6684744200fbeec433130bd545eee2ff570f2e4423e9b2fc88900f313096c0a2dc21656c7b22019a0e2bdfa69b7848b897e
- SSDEEP 3072:r4dfK+rboXzrXVH8K3s6DUCDXFRYgjrjKU8JGnhT4NZtuqzmGvWlRq528I9fOUL1:rQbrboXzrFHocPXXnjKUW08uemEqRq5y
- TLSH T1F2F312CF3C1D7004E823F88CF275C9229AF953C55B1B946B906A136A79A907B30C7B75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
blackmatter
Version
-
25.239
Signatures
- Family: BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
- Family: Lockbit
Ransomware family with multiple variants released since late 2019.
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
resource yara_rule static1/unpack001/LockBit/builder.exe family_lockbit - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/LockBit/builder.exe unpack001/LockBit/keygen.exe
File Explorer
-
LockBit_LockBit.rar.rar 158KB
-
LockBit/Build.bat767B
-
LockBit/README.md1KB
-
LockBit/builder.exe.exe 469KB
-
LockBit/config.json8KB
-
LockBit/keygen.exe.exe 31KB
LockBit/Build.bat
- SHA256 7f6528ce5ebb8dcf7598d26d606db1d7f6419593ce589af363a4fcb18668f2b0
- MD5 0173b6cb7d6c8c41e73f8a6518a089d8
- SHA1 790d4a3d7db86aa8ebb8c4af2a8d138266164643
- SHA512 ebe66e432e7693b2d5851f4c08d5289e2b5364d1bf327a1ba912d49e5b5cf3fa03886d30d2abc747747899451ff9db02e830566c61eb3708614e903aba45d7df
- TLSH T187014873C08958B358779C48A5F1DB16FFAF3BC68AC3808DD91C763D5226022173629B
- MD5 SHA1 SHA512 TLSH
LockBit/README.md
- SHA256 d6a8522a6c318abae02da772664ffaaa82e32de5e55290559295810c6ec8b197
- MD5 b42731a581d5cd7eea7783ef9d0d6800
- SHA1 61e47134c9a6c1711dc8cde7ca7eb5e0eb3f4d2b
- SHA512 a86611fc0d21b2520c473a8fdaa0f1c116d9d6c1e201ddecf6a04b9bc9c3580f55a20fca74471689d381a3b8083037b75a8018d2ac6294206a04bbd7ddf10a89
- TLSH T12041850B777D1F7A07CB43D626E3226BEB7FA99D32274A1C445A9408638940C83332F8
- MD5 SHA1 SHA512 TLSH
LockBit/builder.exe
- IMPHASH d2e26e45dcb84f1062f90f29a9cf0faa
- SHA256 a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
- MD5 c2bc344f6dde0573ea9acdfb6698bf4c
- SHA1 d6ae7dc2462c8c35c4a074b0a62f07cfef873c77
- SHA512 d60cf86c0267cd4e88d21768665bbb43f3048dace1e0013b2361c5bfabf2656ff6215dfb75b6932e09545473305b4f707c069721cdde317b1df1709cd9fc61c0
- SSDEEP 12288:CzVXpdg/1MB94JD7RfaVT1hG98P67PNV3giFH6J1VjR3L6dpbQrQyEpInmwuRUfB:CzxjgdRpBq1hG98P67PNV3giFH6J1Vjn
- TLSH T10EA48D11B225D073D07714F67B6BB129B3AF4D3C0A796803EAD41F0938B59A3AF11A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15780
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
MessageBoxW
kernel32
LoadResource
WriteFile
CreateFileW
ExitProcess
FindResourceW
GetCommandLineW
GetFileSize
GetModuleHandleW
GlobalFree
SizeofResource
LockResource
ReadFile
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
sprintf
strchr
strcpy
strlen
strstr
wcscat
wcscpy
wcslen
wcsrchr
localeconv
_stricmp
_strcmpi
tolower
realloc
malloc
free
strtod
strncmp
imagehlp
CheckSumMappedFile
ntdll
RtlFreeHeap
RtlAllocateHeap
NtClose
RtlImageNtHeader
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
438KB
Virtual Size
438KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
LockBit/config.json
- SHA256 d121f4293160e0a39cbb184c032cd45baf1372db00cd33afb0e166ac0a60ac4c
- MD5 de177fa08e9b2eaa378760afd53be6b2
- SHA1 a18050f9e5f2412955df4b868ffb866209d2b84a
- SHA512 44f4e745013eaa7d95486c91457c23fd9694f859920766f0139cf5ca9c84ff6c82d59be9675dd1a0c7b3216464c85cf732dbbdb0e641a5e47cbbf1830f4a0a8c
- SSDEEP 192:4m26pOWU6ig4HJmLDHqlexR4LjIuoIyig4H8mLDHU:4ba5U6ApmZ+IoyAcm0
- TLSH T17902B26CDE3D2C3985C07C81ABDBBDA3E2B7619744C41A09B858C62D4F0DF1B61A67E4
- MD5 SHA1 SHA512 SSDEEP TLSH
LockBit/keygen.exe
- IMPHASH 73eeda700d0a0376845c61c44155f4a8
- SHA256 ea6d4dedd8c85e4a6bb60408a0dc1d56def1f4ad4f069c730dc5431b1c23da37
- MD5 71c3b2f765b04d0b7ea0328f6ce0c4e2
- SHA1 bf8ecb6519f16a4838ceb0a49097bcc3ef30f3c4
- SHA512 1923db134d7cee25389a07e4d48894dde7ee8f70d008cd890dd34a03b2741a54ec1555e6821755e5af8eae377ef5005e3f9afceb4681059bc1880276e9bcf035
- SSDEEP 768:A6+T41GjHbdWCWDwDD01riWpJxKpAQJs/3JGIDLQ5:b+U+hHIBpJxixgQ
- TLSH T1A2E2F6439695B8B7D47693B2322BC6FD8DF10D16026F667B0B3FF8701932C429B24699
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
wsprintfA
kernel32
GetCurrentDirectoryW
WriteFile
CloseHandle
CreateFileW
ExitProcess
GetCommandLineW
GlobalFree
SetCurrentDirectoryW
shell32
CommandLineToArgvW
msvcrt
_wcsicmp
memcpy
memset
free
fputc
exit
calloc
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE