🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5
SHA3-384 hash: ddb889bd6cf66f6470673f0928ad4e0d4d491c40ed5efff05a4d7a0845cac1885364afff01bdb069858ba9c5c32f06b1
SHA1 hash: faafd96ac68278360353c35d0bf3d5a353292f11
MD5 hash: bd440d2c348b4cc4b6ad75f92d9e1c13
humanhash: avocado-butter-salami-romeo
File name:391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5
Download: download sample
Signature LockBit
Create hunting rule
File size:165'888 bytes
First seen:2022-07-05 21:03:10 UTC
Last seen:2022-07-05 21:35:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a50a0d82b9120fc73965c28fea79e1f9 (4 x LockBit, 3 x BlackMatter)
ssdeep 3072:Iy1IbCkfer2IsGpQf8oFTO3PfvXdG4pcT+fwfNZi5kSpRIFf34icFQ+d5S:IcxkOTpQ8olO/fvc5T+iNEkJ34igQ+/S
Threatray 1 similar samples on MalwareBazaar
TLSH T17DF31265F34C0FBEE8A26EB6586C578054CB4BEA40942FCBE56C6B9C03CD31429FC956
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter Arkbird_SOLG
Tags:exe lockbit lockbit black lockbit3 Ransomware


Avatar
ArkbirdDevil
Thanks to @threatable for the sample

Intelligence

File Origin
# of uploads :
2
# of downloads :
757
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5.exe
Verdict:
Suspicious activity
Analysis date:
2022-07-06 01:57:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7098b423-9b83-49e9-84b5-250d0ad9b7e4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Variant.Lazy.205804.23302.11889.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
filecoder lockbit packed ransomware
Link:
https://www.filescan.io/uploads/62c4a77f11764e36f8184281/reports/e1579ccb-a3d1-4893-8ef8-1070606a7e25/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4b476e09-dcca-4031-b35d-59ce9ccea77e
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1025157
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5/
Threat name:
Win32.Ransomware.Lockbit
Create hunting rule
Status:
Malicious
First seen:
2022-07-05 18:08:12 UTC
File Type:
PE (Exe)
AV detection:
31 of 39 (79.49%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=henjpix6npvwox7dkdvtzif4hkmv7wsd2avhuycgzvepaqqffxsq._file
Verdict:
malicious
Similar samples:
80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
LockBit
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220705-zwkqksdaar/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5
MD5 hash:
bd440d2c348b4cc4b6ad75f92d9e1c13
SHA1 hash:
faafd96ac68278360353c35d0bf3d5a353292f11
Link:
https://www.unpac.me/results/d0e8e307-ad4b-4b7e-a705-67893c5f7841/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lockbit
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:LockBit3Detect_via_SectionPatterns
Create hunting rule
Author:InterProbe Malware-Vulnerability Research Team
Description:Detects new LockBit 3.0 variants
Rule name:LockbitBlack_Loader
Create hunting rule
Author:Zander Work
Description:Hunting rule for the Lockbit Black loader, based on https://twitter.com/vxunderground/status/1543661557883740161
Rule name:LockbitBlack_Loader_Rule
Create hunting rule
Author:Luis Fabuel
Description:Hunting rule for the Lockbit Black loader, based on https://twitter.com/vxunderground/status/1543661557883740161

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments