MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44deff9f627fb57a5150b5ae96961a525958106fc8d13d7edbaf0f074dc3b8c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 44deff9f627fb57a5150b5ae96961a525958106fc8d13d7edbaf0f074dc3b8c0
SHA3-384 hash: 69af5b51fc3666f939ed3addfadef23816879e92a75198cdb35366f96c0bb68e0c7a0454515d3fd3fb6204385e913277
SHA1 hash: b01fa76e2730aebf43b597f2c0b35af1c491f177
MD5 hash: 9361c2ea4a806597afe7011b895aca6f
humanhash: cola-gee-ceiling-mike
File name:44deff9f627fb57a5150b5ae96961a525958106fc8d13d7edbaf0f074dc3b8c0
Download: download sample
Signature LockBit
Create hunting rule
File size:241'152 bytes
First seen:2020-11-07 22:28:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a90ec4472bb922de724694ecfecd29ee (1 x LockBit)
ssdeep 3072:pGVNT0BOZTsPe3b+Qv0FHRdry0HDEz3H/pCn2iO7azwGFIvZ3n+CRtDASVsPHNw:XIZTl3b+Qv0a5azwGqvZX+CDAvfq
Threatray 2 similar samples on MalwareBazaar
TLSH 4234BF21BFE2CC33E56744394821A3A0B67B7D262578CD463B902FBA9D325815BFB351
Reporter seifreed
Tags:lockbit

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'809
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Titirez-9781447-0
Create hunting rule

Win.Packed.Generickdz-9785340-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
Creating a file
Running batch commands
Creating a process with a hidden window
Creating a file in the Program Files subdirectories
Modifying an executable file
Moving a file to the Program Files subdirectory
Launching a service
Launching a process
Connection attempt
Creating a file in the Windows subdirectories
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Preventing system recovery
Forced shutdown of a browser
Encrypting user's files
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/44deff9f627fb57a5150b5ae96961a525958106fc8d13d7edbaf0f074dc3b8c0/
Threat name:
Win32.Trojan.MintTitirez
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 22:38:07 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0a937d4fe8aa6cb947b95841c490d73e452a3cafcd92645afc353006786aba76
LockBit
3d569e91d2ca75b52e3baa820cf909bb86e8163fcc8a03a7d88dd37654914cd2
LockBit
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit evasion persistence ransomware
Link:
https://tria.ge/reports/201108-ctkgqh6cfs/
Behaviour
Interacts with shadow copies
Modifies Control Panel
Modifies Internet Explorer settings
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Drops file in Program Files directory
Modifies service
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Drops desktop.ini file(s)
Enumerates connected drives
Deletes itself
Deletes backup catalog
Modifies extensions of user files
Deletes shadow copies
Deletes system backup catalog
Modifies boot configuration data using bcdedit
Lockbit
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_ransom_lockbit_1
Create hunting rule
Author:@VK_Intel
Description:Detects LockBit ransomware
Reference:twitter
Rule name:Lockbit
Create hunting rule
Author:kevoreilly
Description:Lockbit Payload
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments