MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a61687dca6e71baa451a3ba677299af8c0b8d576f7e348609aa43162ca550dc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
LockBit
Vendor detections: 14
| SHA256 hash: | a61687dca6e71baa451a3ba677299af8c0b8d576f7e348609aa43162ca550dc3 |
|---|---|
| SHA3-384 hash: | 8c751c6a7c9a34f3afecdec41490ad3897fba1ad601755249eef37825f9208aeaddb7f70dc1687c696e0455d2f23495d |
| SHA1 hash: | 6644e6e6e57ec05e0919cd7de2306b3800a272fb |
| MD5 hash: | 9698c2af88de2ca817dd83f394a2be5d |
| humanhash: | bulldog-zebra-uniform-eighteen |
| File name: | LB3_pass.exe |
| Download: | download sample |
| Signature | LockBit |
| File size: | 148'480 bytes |
| First seen: | 2025-12-19 11:58:10 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 914685b69f2ac2ff61b6b0f1883a054d (36 x BlackMatter, 16 x LockBit, 1 x BlackMatte) |
| ssdeep | 3072:l7iU6uq8updgvFD8KzN/lyGeNOvCnkvxj5RaPUdQeSuDN4esFnhvQXQlm1Y:l7i3p80gvZ5lkOR9ccdQbuDN4plhImmK |
| Threatray | 4 similar samples on MalwareBazaar |
| TLSH | T1EDE312E69382D36AC849D2BED1A675906503CC64FF52CFE52D534C3BB281CAA9C4C71B |
| TrID | 25.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 19.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.1% (.EXE) Win32 Executable (generic) (4504/4/1) 7.8% (.EXE) Win16/32 Executable Delphi generic (2072/23) 7.8% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| Reporter |  NDA0E |
| Tags: | BlackMatter exe lockbit |
Intelligence
File Origin
# of uploads :
1
# of downloads :
698
Origin country :
CHVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
LB3_pass.exe
Verdict:
No threats detected
Analysis date:
2025-12-19 12:00:52 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Clean
Score:
84.2%
Tags:
n/a
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
blackmatter crypt filecoder fingerprint lockbit lockbit3 packed ransomware xpack
Verdict:
Malicious
Labled as:
Ransom.BlackMatter.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-19T09:06:00Z UTC
Last seen:
2025-12-19T18:07:00Z UTC
Hits:
~10
Detections:
Trojan-Ransom.Win32.Lockbit.sb HEUR:Trojan-Ransom.Win32.Generic
Malware family:
BlackMatter Ransomware
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.LockBit
Threat name:
Win32.Ransomware.Lockbit
Status:
Malicious
First seen:
2025-12-19 11:40:17 UTC
File Type:
PE (Exe)
AV detection:
32 of 36 (88.89%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
lockbit
Result
Malware family:
lockbit
Score:
10/10
Tags:
family:lockbit discovery ransomware
Behaviour
Program crash
System Location Discovery: System Language Discovery
Lockbit
Lockbit family
Rule to detect Lockbit 3.0 ransomware Windows payload
Verdict:
Malicious
Tags:
ransomware lockbit
YARA:
RAN_Lockbit_v3_Jun_2022_1 RANSOM_Lockbit_Black_Packer Windows_Ransomware_Lockbit_369e1e94 LockBit3 MAL_RANSOM_Lockbit_Indicators_Feb24 MAL_RANSOM_LockBit_Indicators_Feb24_RID3362
Unpacked files
SH256 hash:
a61687dca6e71baa451a3ba677299af8c0b8d576f7e348609aa43162ca550dc3
MD5 hash:
9698c2af88de2ca817dd83f394a2be5d
SHA1 hash:
6644e6e6e57ec05e0919cd7de2306b3800a272fb
Detections:
win_lockbit_auto
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lockbit
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | CyberCrime_LockBit_Ransomware |
|---|---|
| Author: | gmrdkd@s2w.inc |
| Description: | Detection LockBit 3.0/Black rule |
| Rule name: | LockBit3_ransomware |
|---|---|
| Author: | BlackBerry |
| Description: | Rule detecting Lockbit3 ransomware samples |
| Rule name: | LockbitBlack_Loader |
|---|---|
| Author: | Zander Work |
| Description: | Hunting rule for the Lockbit Black loader, based on https://twitter.com/vxunderground/status/1543661557883740161 |
| Rule name: | RANSOM_Lockbit_Black_Packer |
|---|---|
| Author: | SECUINFRA Falcon Team |
| Description: | Detects the packer used by Lockbit Black (Version 3) |
| Reference: | https://twitter.com/vxunderground/status/1543661557883740161 |
| Rule name: | RAN_Lockbit_v3_Jun_2022_1 |
|---|---|
| Author: | Arkbird_SOLG |
| Description: | Detect the lockbit ransomware |
| Reference: | https://twitter.com/vxunderground/status/1543661557883740161 |
| Rule name: | Windows_Ransomware_Lockbit_369e1e94 |
|---|---|
| Author: | Elastic Security |
| Rule name: | win_lockbit_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.lockbit. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.