🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f
SHA3-384 hash: b2b739466960a650b319a6ff40362231fb29706cdb6d487230d52856e35a233eae3e8f74d47616fcf164bfc1ae92c0cb
SHA1 hash: e809a61e0288fd77c3bbf43f55064fd2041f1df0
MD5 hash: dfac83994c43a8cba786c678f383e8f3
humanhash: snake-colorado-network-lemon
File name:f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f
Download: download sample
Signature LockBit
Create hunting rule
File size:61'952 bytes
First seen:2025-06-25 08:01:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b5529c9330b834874c59d84d7b46e90e (2 x LockBit)
ssdeep 768:b8KivX+gIMiYzTBO6d3tG4t29U4mvn+KxXWgQUfhNu5NhmncHhs50Z1Iw6Wx:bhivX0MDzTQmtG4tSd6+f+hgnh0p+Z5
TLSH T1A253F26F5F8AB165CA4FEF70E3258030211ACFA845962684D91156AC20FB3CF5EF0D4D
TrID 42.7% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter TheRavenFile
Tags:exe lockbit lockbit4 lockbit4.0 Ransomware


Avatar
RakeshKrish12
Source: https://github.com/TheRavenFile/Daily-Hunt/blob/main/LockBit%204.0%20Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'124
Origin country :
IN IN
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
rl_f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f
Verdict:
Malicious activity
Analysis date:
2025-06-25 08:03:07 UTC
Tags:
ransomware stealer
Link:
https://app.any.run/tasks/da03ca88-0023-4069-85ac-b6853df0c968

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
LockBit
Create hunting rule
Link:
https://www.capesandbox.com/analysis/11059/
Detection(s):
SecuriteInfo.com.Trojan.Encoder.41863.20282.3178.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685bace4b06783b9ebd73a33
Tags:
ransomware shellcode agentb crypt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Creating a file
Changing a file
Creating a file in the Program Files directory
Creating a file in the Program Files subdirectories
Connection attempt
Creating a window
Moving a file to the Program Files directory
Moving a file to the Program Files subdirectory
Modifies multiple files
Modifying an executable file
Replacing files
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Replacing executable files
Moving a file to the %AppData% subdirectory
Moving of the original file
Creating a file in the mass storage device
Encrypting user's files
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug packed packed packer_detected upx
Link:
https://www.filescan.io/uploads/685baceacf2af1571117a570/reports/731800a9-845d-42e5-a37b-746c684686d1/overview
Verdict:
Malicious
Labled as:
Fragtor.Generic
Link:
https://www.hybrid-analysis.com/sample/f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f
Malware family:
Ramnit
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ae69624c-a3c7-460f-b6f5-7be35db5eefe
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 32 Exe x86
Link:
https://app.malva.re/file/dfac83994c43a8cba786c678f383e8f3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f
Threat name:
Win32.Ransomware.LockBit
Create hunting rule
Status:
Malicious
First seen:
2025-03-28 10:39:20 UTC
File Type:
PE (Exe)
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6u7yjlbe4cxehtk3lgqoamowii7y3treadjb4dkz5jkrdnl7evxq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access discovery spyware stealer
Link:
https://tria.ge/reports/250625-jwteqavrw6/
Behaviour
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Enumerates connected drives
Credentials from Password Stores: Windows Credential Manager
Deletes itself
Reads user/profile data of web browsers
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c39c403c-0909-49c5-9df9-617550a0f255
Unpacked files
SH256 hash:
f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f
MD5 hash:
dfac83994c43a8cba786c678f383e8f3
SHA1 hash:
e809a61e0288fd77c3bbf43f55064fd2041f1df0
Link:
https://www.unpac.me/results/63ff673c-40e9-4e50-ba27-f2af3e41be1b/
SH256 hash:
2b744a55d14d63017180ad4aed4c29a6cd0f36c9bb44314d471a90df7292235d
MD5 hash:
f3472c84e1d979a5fac3d1148b16b897
SHA1 hash:
c27eb7e0e4926712dea3b6ec5ca2e7ded6d7b326
Link:
https://www.unpac.me/results/63ff673c-40e9-4e50-ba27-f2af3e41be1b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/f53f84ac24e0ae43cd5b59a0e031d6423f8dce2400d21e0d59ea5511b57f256f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MAL_RANSOM_LockBit_Apr23_1
Create hunting rule
Author:Florian Roth
Description:Detects indicators found in LockBit ransomware
Reference:https://objective-see.org/blog/blog_0x75.html
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/11059/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.DLL::LoadLibraryA

Comments