🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 742489bd828bdcd5caaed00dccdb7a05259986801bfd365492714746cb57eb55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 7


Intelligence 7 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 742489bd828bdcd5caaed00dccdb7a05259986801bfd365492714746cb57eb55
SHA3-384 hash: 1758f56c3fdfaea4484237c9476864c4530b76e4223f17f3f9b9c33bdaa6bc10da73bfda1b7368af1aef8437b8e34d80
SHA1 hash: 2a4f6fea8b4e726d01b0d1b1e629d3a392e063c1
MD5 hash: 32844e92bbd498244e3a2d8486181ae4
humanhash: indigo-speaker-emma-saturn
File name:742489bd828bdcd5caaed00dccdb7a05259986801bfd365492714746cb57eb55.bin
Download: download sample
Signature LockBit
Create hunting rule
File size:166'400 bytes
First seen:2022-07-16 20:36:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 50e4645798779602979868f1b8517523 (2 x LockBit)
ssdeep 3072:e6u2G0diw9r2iyJE/rdfzGO8EhwJYWB475vj0na8BY2TgJn54QEHdM2uoecqwZ:P1L9Byo5fzGO8EcNK75vYVTED/E9M2uS
Threatray 5 similar samples on MalwareBazaar
TLSH T1CCF31216EA7097AEC681A97703992083CD24DC7D0083542766FD827CBCECB1B6D727D8
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter Arkbird_SOLG
Tags:exe lockbit lockbit black Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
877
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291253/
Detection(s):
SecuriteInfo.com.Variant.Ransom.Lockbit3.10.26560.24307.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Gathering data
Malware family:
LockBit Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d8c05667-498a-4ab3-b37e-f0c3f5bd7644
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1034019
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/742489bd828bdcd5caaed00dccdb7a05259986801bfd365492714746cb57eb55/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2022-07-09 01:02:18 UTC
File Type:
PE (Exe)
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oqsitpmcrponlsvo2ag4zw32ausztbuadp6tmvesofduns2x5nkq._file
Verdict:
malicious
Similar samples:
0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509
LockBit
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5
LockBit
80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
LockBit
c6cf5fd8f71abaf5645b8423f404183b3dea180b69080f53b9678500bab6f0de
LockBit
f9b9d45339db9164a3861bf61758b7f41e6bcfb5bc93404e296e2918e52ccc10
LockBit
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220716-zd5ysseab6/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
742489bd828bdcd5caaed00dccdb7a05259986801bfd365492714746cb57eb55
MD5 hash:
32844e92bbd498244e3a2d8486181ae4
SHA1 hash:
2a4f6fea8b4e726d01b0d1b1e629d3a392e063c1
Link:
https://www.unpac.me/results/2fc4ea30-0758-45a5-b1e8-5c605f1317b9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lockbit
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/742489bd828bdcd5caaed00dccdb7a05259986801bfd365492714746cb57eb55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:LockbitBlack_Loader
Create hunting rule
Author:Zander Work
Description:Hunting rule for the Lockbit Black loader, based on https://twitter.com/vxunderground/status/1543661557883740161
Rule name:LockbitBlack_Loader_Rule
Create hunting rule
Author:Luis Fabuel
Description:Hunting rule for the Lockbit Black loader, based on https://twitter.com/vxunderground/status/1543661557883740161
Rule name:RANSOM_Lockbit_Black_Packer
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the packer used by Lockbit Black (Version 3)
Reference:https://twitter.com/vxunderground/status/1543661557883740161
Rule name:V3_Lockbit_Black_Packer
Create hunting rule
Author:Luis F.R
Description:Detects the packer used by Lockbit Black (Version 3)
Reference:https://twitter.com/vxunderground/status/1543661557883740161

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/291253/

Comments