🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40b2724e08232e2a46f3ee36e9b0e5ee2bb49e81570abeb28035adc71db8ac99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40b2724e08232e2a46f3ee36e9b0e5ee2bb49e81570abeb28035adc71db8ac99
SHA3-384 hash: e6fd3a32f41324afe27652c6675216f42ff30b0e645a1e53d9d5b9f479ca836020214ca130bbd506cb9210faa8ef310e
SHA1 hash: cee174ab8c94de29112b379fb993120fe706dcba
MD5 hash: 3bd81a1cfdff23adf929b89e07452441
humanhash: triple-enemy-speaker-freddie
File name:cee174ab8c94de29112b379fb993120fe706dcba
Download: download sample
Signature LockBit
Create hunting rule
File size:268'040 bytes
First seen:2022-03-15 23:36:06 UTC
Last seen:2022-03-16 01:35:25 UTC
File type: elf
MIME type:application/x-executable
ssdeep 6144:W7ZzUdcez3qK74XY+5gdWSlqqD4qgf2bVgu:WuepeISIqPg+b
TLSH T1AE446C0FB49294BDC0ABE83097DF99B266257DCD4314393B7282E9313523B642F5AF46
telfhash t1c1019e19a93c07dc48416c14c84d4b8341abd62b4079f604ff55dcd04a5d91af234c5a
Reporter vxunderground
Tags:elf lockbit Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'043
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Encoder.128.13337.26893.UNOFFICIAL
Create hunting rule

Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/6231231eb94fb38cb4894579/reports/b9713264-9715-47b0-9604-a3153ec4808c/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
x86
Packer:
not packed
Botnet:
unknown
Number of open files:
8
Number of processes launched:
1
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/40b2724e08232e2a46f3ee36e9b0e5ee2bb49e81570abeb28035adc71db8ac99
Behaviour
Anti-Debugging
Process Inject
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/933631b0-7c27-4f2e-b60d-ba65e3f387fb
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/957569
Signature
Found Tor onion address
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected LockBit ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 590049 Sample: ryAK9001G8 Startdate: 16/03/2022 Architecture: LINUX Score: 64 39 109.202.202.202, 80 INIT7CH Switzerland 2->39 41 91.189.91.42, 443 CANONICAL-ASGB United Kingdom 2->41 43 91.189.91.43, 443 CANONICAL-ASGB United Kingdom 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 Yara detected LockBit ransomware 2->47 49 Machine Learning detection for sample 2->49 51 Found Tor onion address 2->51 9 systemd logrotate 2->9         started        11 systemd mandb ryAK9001G8 2->11         started        13 systemd install 2->13         started        15 systemd find 2->15         started        signatures3 process4 process5 17 logrotate sh 9->17         started        19 logrotate sh 9->19         started        21 logrotate gzip 9->21         started        23 logrotate gzip 9->23         started        process6 25 sh invoke-rc.d 17->25         started        27 sh rsyslog-rotate 19->27         started        process7 29 invoke-rc.d runlevel 25->29         started        31 invoke-rc.d systemctl 25->31         started        33 invoke-rc.d ls 25->33         started        35 invoke-rc.d systemctl 25->35         started        37 rsyslog-rotate systemctl 27->37         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40b2724e08232e2a46f3ee36e9b0e5ee2bb49e81570abeb28035adc71db8ac99/
Threat name:
Linux.Ransomware.LockBit
Create hunting rule
Status:
Malicious
First seen:
2022-03-12 22:36:00 UTC
File Type:
ELF64 Little (Exe)
AV detection:
21 of 42 (50.00%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/220315-3l481sehgj/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40b2724e08232e2a46f3ee36e9b0e5ee2bb49e81570abeb28035adc71db8ac99

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments