MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4
SHA3-384 hash: bc75aaa5ba5760fb2de5e176f017dc5a5b4c38449ce099ab199ec086ee6ff029d5f708e42209769536bba8ac02f7f896
SHA1 hash: 12117609b746257a6cdd2808dcb50c6af9c1810d
MD5 hash: 48aa442a0670b65a82eee99c1ed1ac78
humanhash: muppet-south-mountain-video
File name:2.이력서_221112(빠릿하게 일하는모습 모여드리겠습니다).exe
Download: download sample
Signature LockBit
Create hunting rule
File size:1'618'290 bytes
First seen:2022-11-16 17:49:50 UTC
Last seen:2022-11-16 19:52:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki)
ssdeep 24576:9bas1P80H8OziJNLCubRnkkBqKU3QMNrm1gPB7MjsjfoxKHHU4tsQkdZ:VlH8ucW9jhmyPBYjSzHHU4tshdZ
Threatray 57 similar samples on MalwareBazaar
TLSH T14E751282E58884E7F87D8A71443B9D23D9676C3F59E92DCE6288F15119B7282131FC2F
TrID 71.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
11.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 9a414d91010101b6 (1 x LockBit)
Reporter Jagdtiger88mm
Tags:exe lockbit Ransomware

Intelligence

File Origin
# of uploads :
2
# of downloads :
737
Origin country :
KR KR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
;이력서_221112(빠릿하게 일하는모습 모여드리겠습니다).exe
Verdict:
Malicious activity
Analysis date:
2022-11-16 04:53:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3652b94f-5d0e-4594-9ea5-5c2c907b4c0f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Lockbit
Create hunting rule
Link:
https://www.capesandbox.com/analysis/334958/
Detection(s):
SecuriteInfo.com.Trojan.Encoder.36798.19862.29336.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Sending a custom TCP request
Unauthorized injection to a recently created process
Searching for synchronization primitives
Adding an access-denied ACE
Сreating synchronization primitives
Creating a file in the Windows subdirectories
Changing a file
Creating a file in the Program Files subdirectories
Moving a file to the Program Files subdirectory
Moving a recently created file
Launching the default Windows debugger (dwwin.exe)
Replacing files
Creating a window
Modifying an executable file
Running batch commands
Creating a process with a hidden window
Launching a process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Deleting volume shadow copies
Preventing system recovery
Encrypting user's files
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
filecoder lockbit overlay packed ransomware shell32.dll
Link:
https://www.filescan.io/uploads/637522cb7db879aacbceb247/reports/b00aeee2-d2e8-4d0d-9b09-d0c1cba14d59/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/49c575f4-bace-4c09-a751-b80d63047993
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.spre.expl.evad.troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1114502
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to hide a thread from the debugger
Creates autostart registry keys with suspicious names
Deletes shadow drive data (may be related to ransomware)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found ransom note / readme
Found Tor onion address
Hides threads from debuggers
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Delete shadow copy via WMIC
Spreads via windows shares (copies files to share folders)
Uses bcdedit to modify the Windows boot settings
Writes a notice file (html or txt) to demand a ransom
Yara detected LockBit ransomware
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 747198 Sample: 8#Ub2e4).exe Startdate: 16/11/2022 Architecture: WINDOWS Score: 100 62 Multi AV Scanner detection for domain / URL 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Antivirus detection for URL or domain 2->66 68 8 other signatures 2->68 8 8#Ub2e4).exe 18 2->8         started        12 8#Ub2e4).exe 17 2->12         started        14 8#Ub2e4).exe 2->14         started        process3 file4 50 C:\Users\user\AppData\Local\...\System.dll, PE32 8->50 dropped 78 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 8->78 80 Deletes shadow drive data (may be related to ransomware) 8->80 82 Writes a notice file (html or txt) to demand a ransom 8->82 88 2 other signatures 8->88 16 8#Ub2e4).exe 8 186 8->16         started        21 WerFault.exe 9 8->21         started        23 WerFault.exe 8->23         started        52 C:\Users\user\AppData\Local\...\System.dll, PE32 12->52 dropped 84 Maps a DLL or memory area into another process 12->84 86 Injects a PE file into a foreign processes 12->86 25 8#Ub2e4).exe 12->25         started        54 C:\Users\user\AppData\Local\...\System.dll, PE32 14->54 dropped signatures5 process6 dnsIp7 56 192.168.2.100 unknown unknown 16->56 58 192.168.2.101 unknown unknown 16->58 60 98 other IPs or domains 16->60 38 C:\Users\user\...\Restore-My-Files.txt, ASCII 16->38 dropped 40 C:\Users\user\...\Restore-My-Files.txt, ASCII 16->40 dropped 42 C:\Users\user\...\Restore-My-Files.txt, ASCII 16->42 dropped 48 13 other files (7 malicious) 16->48 dropped 70 Connects to many different private IPs via SMB (likely to spread or exploit) 16->70 72 Connects to many different private IPs (likely to spread or exploit) 16->72 74 Creates autostart registry keys with suspicious names 16->74 76 5 other signatures 16->76 27 cmd.exe 1 16->27         started        44 C:\ProgramData\Microsoft\...\Report.wer, Unicode 21->44 dropped 46 C:\ProgramData\Microsoft\...\Report.wer, Unicode 23->46 dropped file8 signatures9 process10 signatures11 90 May disable shadow drive data (uses vssadmin) 27->90 92 Deletes shadow drive data (may be related to ransomware) 27->92 94 Uses bcdedit to modify the Windows boot settings 27->94 30 WMIC.exe 1 27->30         started        32 conhost.exe 27->32         started        34 vssadmin.exe 1 27->34         started        36 2 other processes 27->36 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4/
Threat name:
Win32.Trojan.DelShad
Create hunting rule
Status:
Malicious
First seen:
2022-11-14 09:22:27 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6357vh7dr5u7radnmadsw7uktlhkz5fcwjyjl5zjp5jjxkmg5k2a._file
Verdict:
malicious
Similar samples:
2cf51d2d9edcfcd6fe5a8c323149832858f9655742dd5e327ee182960e558ad3
LockBit
5a67b802ccb3ff343066d6f285b8c933dbd9b43da1e7592f512d54d6e517b5ee
LockBit
8d141b8ef137032125cece55ec945038c35d4eeed54ce43e0b99c2731e8790ba
LockBit
9aa88ce395cd32b972f79afe6855d74e1071b7a79b6acadeefa2d0c2f6a4530c
LockBit
a2ad5cc5045a1645f07da7eab14ba13eb69ab7286204f61ba6a4226bfade7f17
LockBit
c6902f14bafb0fa5c7b46a3afe0ff71245c0bb26ac07b187ff58fd3fa381dbcb
LockBit
e786673320cd80373f1f1bdd717082d5ea074c4464e2b15874d93dc3cfe35ee1
LockBit
+ 47 additional samples on MalwareBazaar
Result
Malware family:
lockbit
Create hunting rule
Score:
  10/10
Tags:
family:lockbit discovery evasion persistence ransomware
Link:
https://tria.ge/reports/221116-weksgagb8x/
Behaviour
Interacts with shadow copies
Modifies Control Panel
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in System32 directory
Sets desktop wallpaper using registry
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Modifies extensions of user files
Creates a large amount of network flows
Deletes shadow copies
Modifies boot configuration data using bcdedit
Lockbit
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/d9ed140f-f32c-46af-ba2c-639c7f58a6ef
Unpacked files
SH256 hash:
f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4
MD5 hash:
48aa442a0670b65a82eee99c1ed1ac78
SHA1 hash:
12117609b746257a6cdd2808dcb50c6af9c1810d
Link:
https://www.unpac.me/results/fe2d61a2-cce1-4374-8eae-325316ccf173/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f6fbfa9fe38f69f8806d60072b7e8a9aceacf4a2b27095f7297f529ba986eab4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_NullSoftInst_Combo_Oct20_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious NullSoft Installer combination with common Copyright strings
Reference:https://twitter.com/malwrhunterteam/status/1313023627177193472

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/334958/

Comments