sodinokibi | e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b

Reason

config extraction: sodinokibi: invalid character '\u008e' looking for beginning of object key string

General

Target
e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b
Size 157KB
Sample220124-a52ysahab7
SHA256 e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b
MD5 b537e5c602462765015642941cf262ec
SHA1 b07004ddfb0e4ed21c938a2be1cef782246425e3
SHA512 3c7ed26cc2978c2fc36e11feb3fb23699202a4b7899e7edbf0b6858e103c19ab7a78796aaf500388615f711362638019fc7fc6cfcf986ef960a8837eb12e5fda
SSDEEP 3072:4do1zyKzVLbi4etMlwDCnyuKMWTOjR8Vx:ko0K9bnOnuPWTONu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sodinokibi

Sodinokibi/Revil sample 1 IoCs

resource	yara_rule
sample	family_sodinokobi

SHA256 e631a84c3e57d74cae0dc0efd62913b48be4ec3e8b5cc31341cfbb5faf7a1a1b
MD5 b537e5c602462765015642941cf262ec
SHA1 b07004ddfb0e4ed21c938a2be1cef782246425e3
SHA512 3c7ed26cc2978c2fc36e11feb3fb23699202a4b7899e7edbf0b6858e103c19ab7a78796aaf500388615f711362638019fc7fc6cfcf986ef960a8837eb12e5fda
SSDEEP 3072:4do1zyKzVLbi4etMlwDCnyuKMWTOjR8Vx:ko0K9bnOnuPWTONu
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

12324

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths