MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d5ea463e0719ee2d1705ff305cdd8529bd2ff23dde79c502c4f478937a91f874. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
LockBit
Vendor detections: 10
| SHA256 hash: | d5ea463e0719ee2d1705ff305cdd8529bd2ff23dde79c502c4f478937a91f874 |
|---|---|
| SHA3-384 hash: | a9e4511cfc24761030daf9539612eaf26598d562dcf129238550473df8689bd43bb10e98536ac3d2f938756b9e2c95aa |
| SHA1 hash: | db0731d693a1ac46706825dcb91193ae4efec482 |
| MD5 hash: | b3175331ae74ee277e94d3e0bc982bf4 |
| humanhash: | nevada-virginia-eleven-romeo |
| File name: | b3175331_by_Libranalysis |
| Download: | download sample |
| Signature | LockBit |
| File size: | 149'504 bytes |
| First seen: | 2021-05-06 14:01:46 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | e9f710b579880d1b6ff748176eb620f1 (4 x LockBit) |
| ssdeep | 3072:V6ZkRGjkBrmKmY99UpkD1/34bIpVSrtLmqc2LVMMqqD/h2LuTeONA5tIHVc:IS9rLPPUpa3VVEtLXcCqqD/hOQnaMc |
| Threatray | 9 similar samples on MalwareBazaar |
| TLSH | E0E32725F156E276C4E70BB07668CFF658E8A434232090F7DBED0A5C18E4BE16E37256 |
| Reporter |  Libranalysis |
| Tags: | lockbit |
Intelligence
File Origin
# of uploads :
1
# of downloads :
1'519
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8B87A11BCEAB4AA5.exe
Verdict:
Malicious activity
Analysis date:
2021-05-06 13:36:28 UTC
Tags:
ransomware lockbit
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lockbit
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Changing a file
Running batch commands
Creating a process with a hidden window
Creating a file
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Modifying an executable file
Launching a service
Launching a process
Creating a file in the Windows subdirectories
Creating a window
Sending a UDP request
Using the Windows Management Instrumentation requests
Connection attempt
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Preventing system recovery
Forced shutdown of a browser
Encrypting user's files
Result
Threat name:
LockBit ransomware
Detection:
malicious
Classification:
rans.spre.expl.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to hide a thread from the debugger
Contains functionalty to change the wallpaper
Creates files inside the volume driver (system volume information)
Deletes shadow drive data (may be related to ransomware)
Deletes the backup plan of Windows
Found ransom note / readme
Found Tor onion address
Hides threads from debuggers
Machine Learning detection for sample
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Modification of Boot Configuration
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: WannaCry Ransomware
Spreads via windows shares (copies files to share folders)
Uses bcdedit to modify the Windows boot settings
Writes a notice file (html or txt) to demand a ransom
Writes many files with high entropy
Yara detected LockBit ransomware
Yara detected RansomwareGeneric
Behaviour
Behavior Graph:
Threat name:
Win32.Ransomware.LockBit
Status:
Malicious
First seen:
2021-05-06 14:02:10 UTC
File Type:
PE (Exe)
AV detection:
38 of 47 (80.85%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
lockbit
Score:
10/10
Tags:
family:lockbit evasion persistence ransomware
Behaviour
Checks SCSI registry key(s)
Interacts with shadow copies
Modifies Control Panel
Modifies Internet Explorer settings
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Drops desktop.ini file(s)
Enumerates connected drives
Deletes itself
Deletes backup catalog
Modifies extensions of user files
Deletes shadow copies
Modifies boot configuration data using bcdedit
Lockbit
Unpacked files
SH256 hash:
d5ea463e0719ee2d1705ff305cdd8529bd2ff23dde79c502c4f478937a91f874
MD5 hash:
b3175331ae74ee277e94d3e0bc982bf4
SHA1 hash:
db0731d693a1ac46706825dcb91193ae4efec482
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | crime_win32_ransom_lockbit_1 |
|---|---|
| Author: | @VK_Intel |
| Description: | Detects LockBit ransomware |
| Reference: |
| Rule name: | INDICATOR_SUSPICIOUS_ClearWinLogs |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing commands for clearing Windows Event Logs |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) |
| Rule name: | INDICATOR_SUSPICIOUS_GENRansomware |
|---|---|
| Author: | ditekSHen |
| Description: | detects command variations typically used by ransomware |
| Rule name: | INDICATOR_SUSPICIOUS_USNDeleteJournal |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables containing anti-forensic artifcats of deletiing USN change journal. Observed in ransomware |
| Rule name: | INDICATOR_SUSPICOUS_EXE_References_VEEAM |
|---|---|
| Description: | Detects executables containing many references to VEEAM. Observed in ransomware |
| Rule name: | Lockbit |
|---|---|
| Author: | kevoreilly |
| Description: | Lockbit Payload |
| Rule name: | UAC_bypass_bin_mem |
|---|---|
| Author: | James_inthe_box |
| Description: | UAC bypass in files like avemaria |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.036] Anti-Behavioral Analysis::Process Environment Block NtGlobalFlag
1) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
2) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
3) [B0012.001] Anti-Static Analysis::Argument Obfuscation
4) [C0001.004] Communication Micro-objective::Connect Socket::Socket Communication
5) [C0001.011] Communication Micro-objective::Create TCP Socket::Socket Communication
6) [C0001.012] Communication Micro-objective::Get Socket Status::Socket Communication
7) [C0001.009] Communication Micro-objective::Initialize Winsock Library::Socket Communication
8) [C0001.001] Communication Micro-objective::Set Socket Config::Socket Communication
9) [C0001.008] Communication Micro-objective::TCP Client::Socket Communication
10) [C0029.004] Cryptography Micro-objective::SHA224::Cryptographic Hash
11) [C0029.003] Cryptography Micro-objective::SHA256::Cryptographic Hash
12) [C0027.001] Cryptography Micro-objective::AES::Encrypt Data
13) [C0021.003] Cryptography Micro-objective::Use API::Generate Pseudo-random Sequence
14) [C0026.002] Data Micro-objective::XOR::Encode Data
15) [C0030.001] Data Micro-objective::MurmurHash::Non-Cryptographic Hash
18) [C0047] File System Micro-objective::Delete File
19) [C0049] File System Micro-objective::Get File Attributes
20) [C0051] File System Micro-objective::Read File
21) [C0050] File System Micro-objective::Set File Attributes
22) [C0052] File System Micro-objective::Writes File
23) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
24) [C0036.007] Operating System Micro-objective::Delete Registry Value::Registry
25) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
26) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
27) [C0036.001] Operating System Micro-objective::Set Registry Key::Registry
28) [C0035] Operating System Micro-objective::Wallpaper
29) [C0043] Process Micro-objective::Check Mutex
30) [C0042] Process Micro-objective::Create Mutex
31) [C0017] Process Micro-objective::Create Process
32) [C0038] Process Micro-objective::Create Thread
33) [C0018] Process Micro-objective::Terminate Process