🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 256e2bf5f3c819e0add95147b606dc314bbcbac32a801a59584f43a4575e25dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 15


Intelligence 15 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 256e2bf5f3c819e0add95147b606dc314bbcbac32a801a59584f43a4575e25dc
SHA3-384 hash: 844ab454453352f91db14c1f5f6084bde455a703b42780e9d45a51bfbd79511e96f7deaff4e874bbea53c5337ce60c4d
SHA1 hash: 35c0d5bb87ea4416579221039cda0a7f6acc5bce
MD5 hash: d5c5558214a0859227e380071925ee58
humanhash: grey-enemy-island-ack
File name:256e2bf5f3c819e0add95147b606dc314bbcbac32a801a59584f43a4575e25dc
Download: download sample
Signature LockBit
Create hunting rule
File size:154'112 bytes
First seen:2022-06-30 11:55:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be232aa2621354bf5dd7b405cc99198c (8 x LockBit)
ssdeep 3072:pm3/OyVPX/1jTCAR4fsp0Vb2xosM89QJ49cqO2DDHMqqD/Tx0Hv/:pq/1VP1OyysNmJyXsqqD/ls/
TLSH T15EE30A3D7498E361C88F00B1BE2516BAE271F83C137495E3EBD34D6A9510FD96626B13
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter JAMESWT_WT
Tags:exe lockbit

Intelligence

File Origin
# of uploads :
1
# of downloads :
600
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
lockbit
Create hunting rule
ID:
1
File name:
862CE999EC7BAD48.e_e
Verdict:
Malicious activity
Analysis date:
2020-12-02 12:58:02 UTC
Tags:
ransomware lockbit
Link:
https://app.any.run/tasks/92aa5ee7-036b-4f2e-bf68-e8a5536f25f8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lockbit
Create hunting rule
Link:
https://www.capesandbox.com/analysis/284590/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file
Creating a window
Searching for synchronization primitives
Changing a file
Replacing files
Enabling the 'hidden' option for recently created files
Moving a file to the Program Files subdirectory
Creating a file in the Program Files subdirectories
Running batch commands
Creating a process with a hidden window
Launching a service
Launching a process
Creating a file in the Windows subdirectories
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Preventing system recovery
Forced shutdown of a browser
Encrypting user's files
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm cmd.exe exploit explorer.exe greyware obfuscated shell32.dll
Link:
https://www.filescan.io/uploads/62bd8f9287c294f96f8c0329/reports/a3d0d915-3a60-4aa8-96b9-fb350a825f22/overview
Malware family:
LockBit Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e475af6d-f967-41ed-8dbf-e6783a768210
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.spre.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1022568
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to hide a thread from the debugger
Contains functionalty to change the wallpaper
Creates files inside the volume driver (system volume information)
Deletes shadow drive data (may be related to ransomware)
Deletes the backup plan of Windows
Found evasive API chain (may stop execution after checking mutex)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found ransom note / readme
Found stalling execution ending in API Sleep call
Found Tor onion address
Hides threads from debuggers
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Spreads via windows shares (copies files to share folders)
Uses bcdedit to modify the Windows boot settings
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Yara detected LockBit ransomware
Yara detected RansomwareGeneric
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 655066 Sample: rLTccOkMfh Startdate: 30/06/2022 Architecture: WINDOWS Score: 100 69 Malicious sample detected (through community Yara rule) 2->69 71 Antivirus detection for URL or domain 2->71 73 Antivirus / Scanner detection for submitted sample 2->73 75 8 other signatures 2->75 7 rLTccOkMfh.exe 2->7         started        11 rLTccOkMfh.exe 7 92 2->11         started        14 rLTccOkMfh.exe 114 2->14         started        16 3 other processes 2->16 process3 dnsIp4 45 C:\...\AppxBlockMap.xml.lockbit (copy), DOS 7->45 dropped 47 C:\Program Files\...\AppxBlockMap.xml, DOS 7->47 dropped 49 C:\...\AppxBundleManifest.xml.lockbit (copy), data 7->49 dropped 57 29 other malicious files 7->57 dropped 85 Connects to many different private IPs via SMB (likely to spread or exploit) 7->85 87 Connects to many different private IPs (likely to spread or exploit) 7->87 89 Deletes shadow drive data (may be related to ransomware) 7->89 91 Uses bcdedit to modify the Windows boot settings 7->91 18 cmd.exe 7->18         started        21 conhost.exe 7->21         started        63 192.168.2.100 unknown unknown 11->63 65 192.168.2.101 unknown unknown 11->65 67 98 other IPs or domains 11->67 51 C:\Users\user\...\Restore-My-Files.txt, ASCII 11->51 dropped 53 C:\Users\user\...\Restore-My-Files.txt, ASCII 11->53 dropped 55 C:\Users\user\...\Restore-My-Files.txt, ASCII 11->55 dropped 59 11 other files (8 malicious) 11->59 dropped 93 Found evasive API chain (may stop execution after checking mutex) 11->93 95 Contains functionalty to change the wallpaper 11->95 97 Found stalling execution ending in API Sleep call 11->97 105 5 other signatures 11->105 23 cmd.exe 1 11->23         started        25 conhost.exe 11->25         started        61 17 other malicious files 14->61 dropped 99 Spreads via windows shares (copies files to share folders) 14->99 101 Hides threads from debuggers 14->101 27 conhost.exe 14->27         started        103 Creates files inside the volume driver (system volume information) 16->103 file5 signatures6 process7 signatures8 77 Deletes the backup plan of Windows 18->77 29 conhost.exe 18->29         started        31 vssadmin.exe 18->31         started        33 WMIC.exe 18->33         started        41 3 other processes 18->41 79 May disable shadow drive data (uses vssadmin) 23->79 81 Deletes shadow drive data (may be related to ransomware) 23->81 83 Uses bcdedit to modify the Windows boot settings 23->83 35 conhost.exe 23->35         started        37 vssadmin.exe 1 23->37         started        39 WMIC.exe 23->39         started        43 3 other processes 23->43 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/256e2bf5f3c819e0add95147b606dc314bbcbac32a801a59584f43a4575e25dc/
Threat name:
Win32.Ransomware.LockBit
Create hunting rule
Status:
Malicious
First seen:
2020-03-12 08:30:00 UTC
File Type:
PE (Exe)
AV detection:
42 of 44 (95.45%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=evxcx5ptzam6blozkfd3mbw4gff3zowdfkabuwkyj5b2iv26exoa._file
Verdict:
malicious
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit evasion persistence ransomware
Link:
https://tria.ge/reports/220630-n31jtscgg4/
Behaviour
Checks SCSI registry key(s)
Interacts with shadow copies
Modifies Control Panel
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks computer location settings
Deletes backup catalog
Modifies extensions of user files
Deletes shadow copies
Modifies boot configuration data using bcdedit
Lockbit
Unpacked files
SH256 hash:
256e2bf5f3c819e0add95147b606dc314bbcbac32a801a59584f43a4575e25dc
MD5 hash:
d5c5558214a0859227e380071925ee58
SHA1 hash:
35c0d5bb87ea4416579221039cda0a7f6acc5bce
Detections:
win_lockbit_auto
Create hunting rule
Link:
https://www.unpac.me/results/24dffe08-5b5c-4471-af12-deed4cb07d61/
Malware family:
LockBit
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/256e2bf5f3c8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/256e2bf5f3c819e0add95147b606dc314bbcbac32a801a59584f43a4575e25dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_lockbit_1
Create hunting rule
Author:@VK_Intel
Description:Detects LockBit ransomware
Reference:twitter
Rule name:ICMLuaUtil_UACMe_M41
Create hunting rule
Author:Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:https://github.com/hfiref0x/UACME
Rule name:INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
Author:ditekSHen
Description:Detects executables containing commands for clearing Windows Event Logs
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:detects command variations typically used by ransomware
Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:detects command variations typically used by ransomware
Rule name:INDICATOR_SUSPICIOUS_USNDeleteJournal
Create hunting rule
Author:ditekSHen
Description:Detects executables containing anti-forensic artifcats of deletiing USN change journal. Observed in ransomware
Rule name:INDICATOR_SUSPICOUS_EXE_References_VEEAM
Create hunting rule
Description:Detects executables containing many references to VEEAM. Observed in ransomware
Rule name:INDICATOR_SUSPICOUS_EXE_References_VEEAM
Create hunting rule
Author:ditekSHen
Description:Detects executables containing many references to VEEAM. Observed in ransomware
Rule name:Lockbit
Create hunting rule
Author:kevoreilly
Description:Lockbit Payload
Rule name:Lockbit
Create hunting rule
Author:kevoreilly
Description:Lockbit Payload
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria
Rule name:win_lockbit_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/284590/

Comments