🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 166aed80bc00d55893d777524235bc89680c8c8192762aff186eee89def0062e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 13


Intelligence 13 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 166aed80bc00d55893d777524235bc89680c8c8192762aff186eee89def0062e
SHA3-384 hash: 79d3cabede63ff7da1382d3874e42768fb454913271498041cb753a3eb45f0d18389cad180331f2da62e6055a585db8d
SHA1 hash: 50ad9c5bcb88574f6e9624ce332d3aea762945cb
MD5 hash: 6586ef47dc8d1450d5f4987e5542daa3
humanhash: cardinal-cat-hamper-blossom
File name:166aed80bc00d55893d777524235bc89680c8c8192762aff186eee89def0062e
Download: download sample
Signature LockBit
Create hunting rule
File size:154'112 bytes
First seen:2022-06-30 11:54:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3a4e687c1b48aeae9f0b75beb8afd136 (1 x LockBit)
ssdeep 3072:vm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDKMqqD/Tx5sIZ:vq/1VP1OyysNmJyXZqqD/l5s
Threatray 15 similar samples on MalwareBazaar
TLSH T19EE3093D7498E361D88F00B1BE2516BAE271F83C037495E3EBD34D6A9510FE96626B13
TrID 33.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
14.0% (.SCR) Windows screen saver (13101/52/3)
11.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter JAMESWT_WT
Tags:exe lockbit

Intelligence

File Origin
# of uploads :
1
# of downloads :
585
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Lockbit
Create hunting rule
Link:
https://www.capesandbox.com/analysis/284584/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file
Creating a window
Changing a file
Replacing files
Searching for synchronization primitives
Enabling the 'hidden' option for recently created files
Moving a recently created file
Moving a file to the Program Files subdirectory
Creating a file in the Program Files subdirectories
Running batch commands
Creating a process with a hidden window
Launching a service
Launching a process
Creating a file in the Windows subdirectories
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Preventing system recovery
Forced shutdown of a browser
Encrypting user's files
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm cmd.exe exploit explorer.exe greyware obfuscated shell32.dll
Link:
https://www.filescan.io/uploads/62bd8f1a1756f979fbcc1bdf/reports/34b1ab85-dbb2-4867-a9e3-209d949dcb15/overview
Malware family:
LockBit Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7165da0e-1ba2-449e-9481-03b5db3a45d0
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.spre.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1022575
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Creates files inside the volume driver (system volume information)
Deletes shadow drive data (may be related to ransomware)
Deletes the backup plan of Windows
Found ransom note / readme
Found Tor onion address
Hides threads from debuggers
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Spreads via windows shares (copies files to share folders)
Uses bcdedit to modify the Windows boot settings
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Yara detected LockBit ransomware
Yara detected RansomwareGeneric
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 655084 Sample: zhAX43vICy Startdate: 30/06/2022 Architecture: WINDOWS Score: 100 69 Malicious sample detected (through community Yara rule) 2->69 71 Antivirus detection for URL or domain 2->71 73 Antivirus / Scanner detection for submitted sample 2->73 75 8 other signatures 2->75 7 zhAX43vICy.exe 2->7         started        11 zhAX43vICy.exe 7 84 2->11         started        14 zhAX43vICy.exe 116 2->14         started        16 3 other processes 2->16 process3 dnsIp4 45 C:\...\AppxBundleManifest.xml.lockbit (copy), DOS 7->45 dropped 47 C:\Program Files\...\AppxBundleManifest.xml, DOS 7->47 dropped 49 C:\...\CodeIntegrity.cat.lockbit (copy), data 7->49 dropped 57 45 other malicious files 7->57 dropped 85 Connects to many different private IPs via SMB (likely to spread or exploit) 7->85 87 Connects to many different private IPs (likely to spread or exploit) 7->87 89 Deletes shadow drive data (may be related to ransomware) 7->89 18 cmd.exe 7->18         started        21 conhost.exe 7->21         started        63 192.168.2.100 unknown unknown 11->63 65 192.168.2.101 unknown unknown 11->65 67 98 other IPs or domains 11->67 51 C:\Users\user\...\Restore-My-Files.txt, ASCII 11->51 dropped 53 C:\Users\user\Desktop\Restore-My-Files.txt, ASCII 11->53 dropped 55 C:\Users\user\...\Restore-My-Files.txt, ASCII 11->55 dropped 59 9 other files (8 malicious) 11->59 dropped 91 Writes a notice file (html or txt) to demand a ransom 11->91 93 Spreads via windows shares (copies files to share folders) 11->93 95 Uses bcdedit to modify the Windows boot settings 11->95 101 2 other signatures 11->101 23 cmd.exe 1 11->23         started        25 conhost.exe 11->25         started        61 24 other files (23 malicious) 14->61 dropped 97 Hides threads from debuggers 14->97 27 conhost.exe 14->27         started        99 Creates files inside the volume driver (system volume information) 16->99 file5 signatures6 process7 signatures8 77 Deletes the backup plan of Windows 18->77 29 conhost.exe 18->29         started        31 vssadmin.exe 18->31         started        33 WMIC.exe 18->33         started        41 3 other processes 18->41 79 May disable shadow drive data (uses vssadmin) 23->79 81 Deletes shadow drive data (may be related to ransomware) 23->81 83 Uses bcdedit to modify the Windows boot settings 23->83 35 WMIC.exe 1 23->35         started        37 conhost.exe 23->37         started        39 vssadmin.exe 1 23->39         started        43 3 other processes 23->43 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/166aed80bc00d55893d777524235bc89680c8c8192762aff186eee89def0062e/
Threat name:
Win32.Ransomware.LockBit
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 03:36:00 UTC
File Type:
PE (Exe)
AV detection:
39 of 44 (88.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=czvo3af4adkvre6xo5jeenn4rfuazdebsj3cv7yyn3xitxxqayxa._file
Verdict:
malicious
Label(s):
ryuk
Create hunting rule
Similar samples:
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76
LockBit
17685fa128c7acff236a0587903405b58d8d664b04ebaa49d00e45fc958acc32
LockBit
1ef9b4f6b4eb3db7eedf738a78ad15db798d397648b5064990c0a01c0da8a125
LockBit
3b52db44c2cdd8adfacb906362837ed449e96fcf761de4b1f26388b66b6edabe
LockBit
44deff9f627fb57a5150b5ae96961a525958106fc8d13d7edbaf0f074dc3b8c0
LockBit
54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97
LockBit
6f298bdb5dbb71a11f826d3501f5bd7ac14f80ba02bffa585dfde1c5ac589082
LockBit
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
LockBit
c6e5a9f39bfc6dc46c2eb7a786948e9d111ddbec5e157c8081f7c22b7d6b3c78
LockBit
d5ea463e0719ee2d1705ff305cdd8529bd2ff23dde79c502c4f478937a91f874
LockBit
+ 5 additional samples on MalwareBazaar
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit evasion persistence ransomware
Link:
https://tria.ge/reports/220630-n2w51sagfp/
Behaviour
Checks SCSI registry key(s)
Interacts with shadow copies
Modifies Control Panel
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks computer location settings
Deletes backup catalog
Modifies extensions of user files
Deletes shadow copies
Modifies boot configuration data using bcdedit
Lockbit
Unpacked files
SH256 hash:
166aed80bc00d55893d777524235bc89680c8c8192762aff186eee89def0062e
MD5 hash:
6586ef47dc8d1450d5f4987e5542daa3
SHA1 hash:
50ad9c5bcb88574f6e9624ce332d3aea762945cb
Detections:
win_lockbit_auto
Create hunting rule
Link:
https://www.unpac.me/results/3051ba37-fbb1-41b2-b119-472cfa8017a5/
Parent samples :
166aed80bc00d55893d777524235bc89680c8c8192762aff186eee89def0062e
1e3bf358c76f4030ffc4437d5fcd80c54bd91b361abb43a4fa6340e62d986770
Malware family:
LockBit
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/166aed80bc00/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/166aed80bc00d55893d777524235bc89680c8c8192762aff186eee89def0062e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_lockbit_1
Create hunting rule
Author:@VK_Intel
Description:Detects LockBit ransomware
Reference:twitter
Rule name:ICMLuaUtil_UACMe_M41
Create hunting rule
Author:Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:https://github.com/hfiref0x/UACME
Rule name:INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
Author:ditekSHen
Description:Detects executables containing commands for clearing Windows Event Logs
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:detects command variations typically used by ransomware
Rule name:INDICATOR_SUSPICIOUS_USNDeleteJournal
Create hunting rule
Author:ditekSHen
Description:Detects executables containing anti-forensic artifcats of deletiing USN change journal. Observed in ransomware
Rule name:INDICATOR_SUSPICOUS_EXE_References_VEEAM
Create hunting rule
Author:ditekSHen
Description:Detects executables containing many references to VEEAM. Observed in ransomware
Rule name:Lockbit
Create hunting rule
Author:kevoreilly
Description:Lockbit Payload
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:win_lockbit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.lockbit.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/284584/

Comments