MalwareAnalysisReports/LockBit5.0/Lockbit 5.0 loader analysis.md at main · VenzoV/MalwareAnalysisReports
Excerpt
analysis.md at main · VenzoV/MalwareAnalysisReports
By VenzoV
Sample Information
SHA256
Summary of execution flow
JMP address values iare obfuscated using opaque predicates and MBA.
Antidebug checks( NtGlobalFlag,PEB-> BeingDebugged, IsDebuggerPresent(), CheckRemoteDebugger() ) .
Dynamically Resolves API. (Full list below).
Maps clean copy of both Kernel32.dll and ntdll.dll to avoid EDR hooks.
Shellcode stubs generated dynamically which perform JMPs to specifc resolved API. Xorshift128 decryption.
Process Injecti…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by GitHub on github.com.
Mentioned in the excerpt
More from GitHub49
- How-to-use-msfvenomGitHub · Added 19 Oct
- GitHub - FallenAstaroth/stink: the cutest python-native infostealerGitHub · Added 18 Oct
- cti/runster/readme.md at main · cert-orangecyberdefense/ctiGitHub · Added 16 Oct
On the same topics
- Ragnar LoaderPRODAFT · Added 18 Oct
- Netwalker malware: What it is, how it works and how to prevent itInfosec Institute · Published 29 Jul 2020
- How CrowdStrike Analyzes macOS Malware to Optimize Automated DetectionCrowdStrike · Published 6 May 2022
- Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomwareMicrosoft · Published 19 May
