🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88bf2b111d33ff40ccb89dc61ead7385a1a3d134bd88946527b85a9b36d34036. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


BlackMatter


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88bf2b111d33ff40ccb89dc61ead7385a1a3d134bd88946527b85a9b36d34036
SHA3-384 hash: 849ecc4f436b0a8a0afa7d7b30edcc0d510f5793222c88ba987d5962eff765635ea16e4424adb9031a1a9d4238b35c5b
SHA1 hash: 4f3aed88beb4cc34d9dfa874a1463a333e8f2b1e
MD5 hash: dfae96c3571d7d8a76333f40cb2cc6d1
humanhash: nineteen-jig-cat-sodium
File name:LBB.exe
Download: download sample
Signature BlackMatter
Create hunting rule
File size:161'792 bytes
First seen:2026-01-29 09:24:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3bc510de773c954bd69d33670cb624d6 (12 x BlackMatter, 3 x LockBit)
ssdeep 3072:BDDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP33680j/xTKkdNNdsyKeEW:L5d/zugZqll3++kfNdsyK
TLSH T16FF37D21B112D037CA6634F6A32AB6B073899E1C12E9A467F7E4CF4B34738236F15947
TrID 25.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
19.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.1% (.EXE) Win32 Executable (generic) (4504/4/1)
7.8% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.8% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter anand_wk
Tags:BlackMatter exe lockbit

Intelligence

File Origin
# of uploads :
1
# of downloads :
395
Origin country :
IN IN
Vendor Threat Intelligence
Malware configuration found for:
LockBit
Details
LockBit
a PCG-lockbit seed, a RSA public key modulus, flags, hashes for excluded folders, files, and extensions, hashes for computer names, killed processes and services, a list of credentials, a ransom note, and information parsed from the ransom note
Link:
https://research.acce.ciphertechsolutions.com/results/0ec55d4c-4888-4ba0-abcb-3f5536d206db/
Malware family:
darkside
Create hunting rule
ID:
1
File name:
LBB.exe
Verdict:
Malicious activity
Analysis date:
2026-01-23 11:25:21 UTC
Tags:
darkside ransomware lockbit braincipher
Link:
https://app.any.run/tasks/97b1d4e6-2933-4ce2-8ea7-ef7803f4f82d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/50632/
Detection(s):
Win.Ransomware.Lazy-10003135-0
Create hunting rule

Win.Ransomware.LockBitBlack-10033143-1
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=697c66639a17da7683b48d19
Tags:
ransomware virus remo
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-23T11:31:00Z UTC
Last seen:
2026-01-31T07:05:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/88bf2b111d33ff40ccb89dc61ead7385a1a3d134bd88946527b85a9b36d34036/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/88bf2b111d33ff40ccb89dc61ead7385a1a3d134bd88946527b85a9b36d34036
Gathering data
Gathering data
Threat name:
Win32.Ransomware.Lockbit
Create hunting rule
Status:
Malicious
First seen:
2026-01-16 01:37:00 UTC
File Type:
PE (Exe)
AV detection:
32 of 36 (88.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rc7swei5gp7ubtfytxdb5lltqwq2hujuxwejizjhxbnjwnwtia3a._file
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/88bf2b111d33/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CRIME_WIN32_RANSOM_BLACKMATTER
Create hunting rule
Author:Rony (@r0ny_123)
Description:Detects Blackmatter ransomware
Rule name:Darkside
Create hunting rule
Author:@bartblaze
Description:Identifies Darkside ransomware.
Rule name:lb_apihashing_code_1
Create hunting rule
Author:0x0d4y
Description:This rule detects samples from the Lockbit3.0 (and BlackMatter) family unpacked in memory, identifying code reuse of key functions.
Rule name:lb_stack_string_decrypt_1
Create hunting rule
Author:CTI Purple Team
Description:This rule detects the code pattern of the Stack Strings decryption algorithm.
Rule name:Windows_Ransomware_Lockbit_369e1e94
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropping
Lockbit
Cape
Cape
https://www.capesandbox.com/analysis/50632/

Comments