🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6cf5fd8f71abaf5645b8423f404183b3dea180b69080f53b9678500bab6f0de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6cf5fd8f71abaf5645b8423f404183b3dea180b69080f53b9678500bab6f0de
SHA3-384 hash: 0e0a63079fec8badc6b7588412b86fcb1a2292b687308fce0e12ba725670bbf039407f3bc494d617d453f57abd633cf3
SHA1 hash: e93b5c6fc09c21fe63465416b1ec1e7487814531
MD5 hash: 612d76c9554ae70cb8596d4adc05e4d4
humanhash: connecticut-football-wolfram-lima
File name:c6cf5fd8f71abaf5645b8423f404183b3dea180b69080f53b9678500bab6f0de.exe
Download: download sample
Signature LockBit
Create hunting rule
File size:165'888 bytes
First seen:2022-07-08 06:51:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a50a0d82b9120fc73965c28fea79e1f9 (4 x LockBit, 3 x BlackMatter)
ssdeep 3072:1iohdPBTTUGSOUXYRZP+0Mp2MhlVykja0FpOhszCFFxiygqWA9BCgWszku1k:1i6KGuXYRh+9p2ilVTaJqCFLU8rzu
Threatray 2 similar samples on MalwareBazaar
TLSH T1D8F323CBF8BE96BCDCD2667D7CE8260DD36FF8DD2CC9884168D524BB0C8545138A8458
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.5% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.EXE) Win16/32 Executable Delphi generic (2072/23)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter Lexsek_
Tags:32 exe lockbit lockbit3 peexe Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
919
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Lazy.205804.4724.1027.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62c7d45111764e36f8218041/reports/b0258bd2-8c0e-47f5-b936-6c9a4b6426a0/overview
Malware family:
LockBit Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/54db99ae-292e-4009-a463-bf4504d4695d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1026995
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6cf5fd8f71abaf5645b8423f404183b3dea180b69080f53b9678500bab6f0de/
Threat name:
Win32.Ransomware.Lockbit
Create hunting rule
Status:
Malicious
First seen:
2022-07-07 13:14:01 UTC
File Type:
PE (Exe)
AV detection:
22 of 25 (88.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y3hv7whxdk5pkzc3qqr7ibayhm66ugalneea6u5zm6cqbovw6dpa._file
Verdict:
malicious
Similar samples:
391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5
LockBit
80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
LockBit
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/220708-hm25tseaar/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
c6cf5fd8f71abaf5645b8423f404183b3dea180b69080f53b9678500bab6f0de
MD5 hash:
612d76c9554ae70cb8596d4adc05e4d4
SHA1 hash:
e93b5c6fc09c21fe63465416b1ec1e7487814531
Link:
https://www.unpac.me/results/7aa91cf6-0ec1-4815-ad07-fca0e7dcd818/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.20
Link:
https://yomi.yoroi.company/submissions/c6cf5fd8f71abaf5645b8423f404183b3dea180b69080f53b9678500bab6f0de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Lockbit3Detect_via_SectionPatterns
Create hunting rule
Author:InterProbe Malware-Vulnerability Research Team
Description:Detects new Lockbit 3.0 variants
Rule name:LockbitBlack_Loader
Create hunting rule
Author:Zander Work
Description:Hunting rule for the Lockbit Black loader, based on https://twitter.com/vxunderground/status/1543661557883740161
Rule name:LockbitBlack_Loader_Rule
Create hunting rule
Author:Luis Fabuel
Description:Hunting rule for the Lockbit Black loader, based on https://twitter.com/vxunderground/status/1543661557883740161
Rule name:RANSOM_Lockbit_Black_Packer
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the packer used by Lockbit Black (Version 3)
Reference:https://twitter.com/vxunderground/status/1543661557883740161
Rule name:V3_Lockbit_Black_Packer
Create hunting rule
Author:Luis F.R
Description:Detects the packer used by Lockbit Black (Version 3)
Reference:https://twitter.com/vxunderground/status/1543661557883740161

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments