MALICIOUS — d2e1b027f118ff76013a42d1b3acb5b9e10b1540f0b1539ca948ce7bd1b36554

MALICIOUS — d2e1b027f118ff76013a42d1b3acb5b9e10b1540f0b1539ca948ce7bd1b36554 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (81/100), attributed to the LockBit family. 6 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: d2e1b027f118ff76013a42d1b3acb5b9e10b1540f0b1539ca948ce7bd1b36554
• SHA-1: 969e0e1a635bd8ceaeacf4f3544998818d8225f6
• MD5: b619972ae9db0593077e0e0a1387c58a
• imphash: d85c69896c9678a0f21735b6ff10352b
• ssdeep: 196608:a46ob5tOcEC7fFLOyomFHKnPm46ob5tOcEC7fFLOyomFHKnP/46ob5tOcEC7fFL:aqltDFxqltDFuqltDFHqltDF
• TLSH: T11471C0AA1640B787E1B0CB60BC14558D903278C472BFADEEF243052F37E65AF554A12E
• Submitted as: d2e1b027f118ff76013a42d1b3acb5b9e10b1540f0b1539ca948ce7bd1b36554
• File type: pe · Size: 17993023 bytes
• Verdict: malicious (81/100) · Family: LockBit

Detections (6 of 52 engines)

• capa (capabilities): capability:collection/keylog
• YARA: Trellix/McAfee ATR: ATR_LockBit_Ransomware
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• LIEF (executable format parser): lief:invalid-authenticode
• Microsoft Defender: Trojan:Win32/CryptInject!pz
• Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

• T1547.001
• T1071.001
• T1056.001

Why this verdict

The malicious score of 81/100 is the fusion of 7 weighted signals:

• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: Trellix/McAfee ATR flagged ATR_LockBit_Ransomware (rule ATR_LockBit_Ransomware) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com
• http://www.pinkworld.com
• http://www.youporn.com
• http://www.redtube.com
• http://www.assparade.com/
• http://www.freeav.com/
• http://www.antispyware.com/
• http://www.antivirus.com/

Embedded domains

• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com
• www.pinkworld.com
• www.youporn.com
• www.redtube.com
• www.assparade.com
• www.freeav.com
• www.antispyware.com
• www.antivirus.com

File paths

• f:\binaries.x86ret\bin\i386\mfc140u.i386.pdb
• X:\:`:d:h:l:p:t:x:
• X:\:`:d:h:l:
• T:\:t:
• X:\:`:d:t:x:
• L:\:`:p:t:x:
• X:\:`:x:
• L:\:`:d:
• D:\:t:
• X:\:l:
• X:\:d:
• X:\:`:h:
• F:\:
• X:\:`:d:h:
• X:\:
• X:\:l:p:
• D:\;t;
• X:\:`:t:x:
• T:\:`:h:l:p:x:
• T:\:`:h:
• H:\:
• C:\:u:
• L:\:n:z:
• O:\:k:y:
• T:\:d:l:t:

More LockBit samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report