🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1
SHA3-384 hash: 310697651069b921c5cdff1d6aed346f57696fb869bbe5005561227c7bce0423162f0990622153bee9572a6012f4c859
SHA1 hash: a8d46a042e6095d7671dbac2aeff74c7bb5e792a
MD5 hash: 37355f4fd63e7abd89bdc841ed98229f
humanhash: seventeen-virginia-sodium-helium
File name:b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1
Download: download sample
Signature LockBit
Create hunting rule
File size:247'808 bytes
First seen:2023-01-31 06:33:46 UTC
Last seen:2023-02-02 20:09:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6c7dcad9de2389724268ab9b2efad94a (1 x LockBit)
ssdeep 3072:s4WFqwI3hbcVWJO5trDcEZn7YhX7wB0SZk5MVMvs4tL7wUQk3lFjMXV:B5MMCtroEVYB7wqMVMIGA
Threatray 32 similar samples on MalwareBazaar
TLSH T17C342A00B95FCBAAD58303BC4953A602FEF7369067248EE793844A701D0B6D676BDF91
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter Anonymous
Tags:exe lockbit Ransomware

Intelligence

File Origin
# of uploads :
3
# of downloads :
861
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1
Verdict:
No threats detected
Analysis date:
2023-01-31 06:35:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c93249e7-175e-427a-944d-d28535da4457

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/358550/
Detection(s):
SecuriteInfo.com.TrojanDownloader.Win64.BazaarLoader.AA.MTB.5636.13356.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Launching a service
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/64197/overview
Behaviour
MalwareBazaar
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
conti greyware lockbit
Link:
https://www.filescan.io/uploads/63d8b65a89bd67c10fdbc561/reports/90dcbbd7-8d20-43c6-904e-ec95969a9d6e/overview
Malware family:
Conti
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/57ae8935-6b3c-42fb-9990-76522861b4ac
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1162183
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Found Tor onion address
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected LockBit ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1/
Threat name:
Win64.Downloader.BazaarLoader
Create hunting rule
Status:
Malicious
First seen:
2023-01-30 19:52:19 UTC
File Type:
PE+ (Dll)
AV detection:
25 of 39 (64.10%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpva6t2efwrra3anj6l46ihcis4e24msglfjbm5x7rxfty36dsqq._file
Verdict:
malicious
Similar samples:
41324493142b10db127217274e21df37f6ccd13f01a8d29d2b23b7b1463423a7
LockBit
41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629
LockBit
8b80be99079be38e93c1712b95bc012ac3017ff9eb2a052a2f2dbde7210110b1
LockBit
a79dcac3753c055d7b46b5ffa27b1b4bb55516180966f20a2878698b81638137
LockBit
cf487bd54e487585cd052e982fd765cbc0d8d164cc21b8635e55475182dadf00
LockBit
ea524e8b0dd046561b59a8d4da5a122aeff02036c87bb03056437a1d0f584039
LockBit
ed4afa874e75b7bac665b9bcbf1d8e1324d4f9263c862755101cd79bb087ad45
LockBit
+ 22 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230131-hbrjysge7t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1
MD5 hash:
37355f4fd63e7abd89bdc841ed98229f
SHA1 hash:
a8d46a042e6095d7671dbac2aeff74c7bb5e792a
Link:
https://www.unpac.me/results/de9fb32b-8d3e-42e1-8480-0eb077f9da2f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b3ea0f4f442d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/358550/

Comments