🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LockBit


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3
SHA3-384 hash: 5f973822069c13063ea0462a45102c440d0c1eb718b226e45553c4c01eb286e74f88e84f1da203938ac7a7232a36839d
SHA1 hash: fd443460ccd1110b0a77385f2f66a38d3f527966
MD5 hash: ea34ac6bf9e8a70bec84e37afeea458a
humanhash: sixteen-iowa-angel-yankee
File name:fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3
Download: download sample
Signature LockBit
Create hunting rule
File size:251'392 bytes
First seen:2023-01-31 06:51:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cf173f5b43e2dd8a6a3952081c406e61 (4 x LockBit)
ssdeep 3072:ZO459Ejzjz10wKaEcKBIacm6QBDOmkm9wXcIfGBF5UgbB67Z:T8HzKxhcKB0VQBLk7XcIkbkt
Threatray 16 similar samples on MalwareBazaar
TLSH T1DD341800F54ECBE9DA9343BC4956A602FEFB328067148AE7D7885A310D075C579BDFA2
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter Anonymous
Tags:exe lockbit Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
984
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3
Verdict:
Malicious activity
Analysis date:
2023-01-31 06:54:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/73f0173e-1506-44ef-9928-67913bc60932

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/358553/
Detection(s):
SecuriteInfo.com.TrojanDownloader.Win64.BazaarLoader.AA.MTB.20122.19600.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Using the Windows Management Instrumentation requests
Launching a service
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/64200/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
conti greyware lockbit
Link:
https://www.filescan.io/uploads/63d8ba942d4f6d560e23ce72/reports/f536fbbf-b620-411b-ad3c-de3dc99b4a59/overview
Malware family:
Conti
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ccf1ff9-2652-4a04-a86d-3de674e8cdef
Result
Threat name:
LockBit ransomware
Create hunting rule
Detection:
malicious
Classification:
rans.expl.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1162188
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Found Tor onion address
Multi AV Scanner detection for submitted file
Yara detected LockBit ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3/
Threat name:
Win64.Downloader.BazaarLoader
Create hunting rule
Status:
Malicious
First seen:
2023-01-30 19:53:29 UTC
File Type:
PE+ (Exe)
AV detection:
18 of 26 (69.23%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ne3sqcxbt6sihpke6xhncweedughwpsnrowj4grblve3uf7btrq._file
Verdict:
malicious
Similar samples:
41420d040d1bae3a9ef3f3ea4a4bc80b0ad3186d84ec067e36e7f485d26f2629
LockBit
8b80be99079be38e93c1712b95bc012ac3017ff9eb2a052a2f2dbde7210110b1
LockBit
a79dcac3753c055d7b46b5ffa27b1b4bb55516180966f20a2878698b81638137
LockBit
af1408a4d276842bea2ff1528fc1d2b93889a1fc4a91c6594fc27af325120da8
LockBit
b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1
LockBit
bc413e02defccc55f1c9925e9cf4fde4a714db1e06c6e021ddbd4b15cf2613d7
LockBit
cf487bd54e487585cd052e982fd765cbc0d8d164cc21b8635e55475182dadf00
LockBit
eeb8390642e2337d11a06654a990a03e93c6f2eed7187de08e4107db4aaf63e3
LockBit
+ 6 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230131-hm3flagf6y/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3
MD5 hash:
ea34ac6bf9e8a70bec84e37afeea458a
SHA1 hash:
fd443460ccd1110b0a77385f2f66a38d3f527966
Link:
https://www.unpac.me/results/fcbe7566-db78-485d-8fd6-a2e01d948e29/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fb49b940570c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/358553/

Comments