Manuel Statik Analiz — LockBit 3.0 Builder | Tehdit: KRITIK
文件 Kimligi
| SHA256 | 0d38f8bf831f1dbb1b02bce1ddb76f3b69c9278e2d48af08e67ecd0f5d43eb0 |
|---|---|
| 文件 Adi | LBB_pass.bin (LockBit Builder) |
| 大小 | 165.888 byte |
| String Sayisi | 804 |
C2 Konfigurasyonu
WoLc2 -- LockBit C2 config string
LockBit 3.0 Hakkinda
LockBit 3.0 (LockBit Black), Eylul 2022'de kaynak kodu (2022 leak) ile yeniden ornekleri ortaya cikan ransomware ailesidir. BlackMatter kodu karistirilmis, ECDH asimetrik sifreleme ve intermittent encryption (kismi dosya sifreleme) kullanir. LBB (LockBit Builder) binary'si, affiliate'lerin ozellestirilmis ransomware ornegi uretmesine olanak tanir.
IOC
| SHA256 | 0d38f8bf831f1dbb1b02bce1ddb76f3b69c9278e2d48af08e67ecd0f5d43eb0 |
|---|---|
| 文件 | LockBit Builder Binary (LBB_pass.bin) |
LockBit — 恶意软件档案
LockBit 3.0 (LockBit Black). bl3.exe builder. CryptProtectMemory DPAPI key protection. WinRAR SFX delivery.
恶意软件类型
Ransomware
编程语言
C++
C2协议
—
目标系统
Windows/Linux
别名 (AKA)
LockBit 3.0
技术细节
C, RSA-2048 + AES-256 sifreleme (hibrid), vssadmin ile shadow copy silme, Active Directory enum, LockBit Builder ile ozel varyant uretimi, multi-threaded encryption, ransom note TXT/HTA
能力与行为
Dosya Şifreleme (AES/RSA)
Gölge Kopya Silme
Yedek Kaldırma
Fidye Notu Oluşturma
Kalıcılık Sağlama
Ağ Paylaşımı Şifreleme
Anti-Analiz Teknikleri
Çift Gasp (Data Leak)
IOC列表 (1 个指标)
IOC — LockBit
# SHA256
0d38f8bf831f1dbb1b02bce1ddb76f3b69c9278e2d48af08e67ecd0f5d43eb0
| 类型 | 值 | 备注 |
|---|---|---|
| sha256 | 0d38f8bf831f1dbb1b02bce1ddb76f3b69c9278e2d48af08e67ecd0f5d43eb0 | len=63 |
C2服务器 (该家族共有 2 台已记录服务器)
| 地址 | 类型 | 端口 | 协议 | 状态 | 国家 |
|---|---|---|---|---|---|
| 35.227.107.189 | ip | 443 | HTTPS | sinkholed | US |
| 89.185.85.239 | ip | 443 | HTTPS | sinkholed | NL |
C2 地址仅来自 KEYDAL 团队人工验证的恶意软件样本。禁止用于商业用途。