sodinokibi | d53e6eb20d40a10c81e23bd9d6c9ebdf6da3c4620583028def3c517f1db09902

Reason

config extraction: CfgExtr crashed: runtime error: slice bounds out of range [:61039] with capacity 32736

General

Target
d53e6eb20d40a10c81e23bd9d6c9ebdf6da3c4620583028def3c517f1db09902
Size 388KB
Sample220124-bbfzwshbc3
SHA256 d53e6eb20d40a10c81e23bd9d6c9ebdf6da3c4620583028def3c517f1db09902
MD5 573ba3a6bd1ed5e08607edd87abf179c
SHA1 7c9f4fea91a14701a3e5cb2f851c3dff34fb5ff2
SHA512 98a634a88e9a27ff0807b93a5c38d57554ea71f7b66602e707cbc8bfb4d6af794895d072f10e55f5d51e401be07ab3c62fbd38eeda6b3e64c843e9e0f08a0f35
SSDEEP 6144:f9oXWTUiy/RqenY2ppLnI9CJiFHbnWJ/gIF+lmLrvGW4:DsDVPFoFHkYIOovGW4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Sodinokibi/Revil sample 1 IoCs

resource	yara_rule
sample	family_sodinokobi

File Explorer

d53e6eb20d40a10c81e23bd9d6c9ebdf6da3c4620583028def3c517f1db09902

.exe 388KB

d53e6eb20d40a10c81e23bd9d6c9ebdf6da3c4620583028def3c517f1db09902

IMPHASH e25b215035074b1994f6c2afab50979b
SHA256 d53e6eb20d40a10c81e23bd9d6c9ebdf6da3c4620583028def3c517f1db09902
MD5 573ba3a6bd1ed5e08607edd87abf179c
SHA1 7c9f4fea91a14701a3e5cb2f851c3dff34fb5ff2
SHA512 98a634a88e9a27ff0807b93a5c38d57554ea71f7b66602e707cbc8bfb4d6af794895d072f10e55f5d51e401be07ab3c62fbd38eeda6b3e64c843e9e0f08a0f35
SSDEEP 6144:f9oXWTUiy/RqenY2ppLnI9CJiFHbnWJ/gIF+lmLrvGW4:DsDVPFoFHkYIOovGW4
MD5 SHA1 SHA512 SSDEEP

windows x86

Sodinokibi/Revil sample

Minor OS version

Major OS version

Entry point

23812

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetPrivateProfileStringW FormatMessageA SetFileTime GetConsoleAliasExesW EnumTimeFormatsW GetUserDefaultLangID GetCommandLineA GetDriveTypeA InitializeCriticalSection AllocateUserPhysicalPages GlobalAlloc IsValidLocale TerminateThread GetThreadSelectorEntry GetCalendarInfoW FormatMessageW GetSystemTimeAdjustment SetConsoleCP WritePrivateProfileStructW CreateSemaphoreA GetFileAttributesW SetMessageWaitingIndicator IsBadWritePtr GetAtomNameW GetCompressedFileSizeA GetTimeZoneInformation lstrlenW GetFileSizeEx SetThreadLocale FindFirstFileA InterlockedFlushSList GetCurrentDirectoryW BindIoCompletionCallback ReadConsoleOutputCharacterA GetLongPathNameA HeapSize DefineDosDeviceW GetFirmwareEnvironmentVariableW IsBadReadPtr SetComputerNameA SetTimerQueueTimer PrepareTape GetProcessVersion LoadLibraryA OpenMutexA InterlockedExchangeAdd LocalAlloc DeleteTimerQueue OpenEventA HeapLock GetCommMask AddAtomA GetPrivateProfileStructA GetThreadPriority CreateIoCompletionPort WaitCommEvent GetModuleHandleA UpdateResourceW FreeEnvironmentStringsW VirtualProtect GetFileAttributesExW OpenEventW GetShortPathNameW OutputDebugStringA DuplicateHandle SetProcessShutdownParameters CloseHandle MoveFileWithProgressW GetFileInformationByHandle FindNextVolumeA WriteProcessMemory lstrcpyW CreateFileW ReadConsoleW ReadFile FlushFileBuffers GetCommProperties SleepEx OpenSemaphoreA QueryDosDeviceA OpenJobObjectA InterlockedIncrement WriteConsoleOutputCharacterA GetCPInfo TlsGetValue WritePrivateProfileStructA lstrlenA GetCommModemStatus CreateTimerQueue GetFullPathNameA GetVolumeNameForVolumeMountPointA EnumSystemCodePagesW GetFullPathNameW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLastError HeapFree RaiseException RtlUnwind HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW IsDebuggerPresent GetProcessHeap ExitProcess GetModuleHandleExW GetCurrentThreadId GetStdHandle GetFileType GetModuleFileNameA WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW GetACP IsValidCodePage GetOEMCP HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx LoadLibraryExW OutputDebugStringW SetStdHandle WriteConsoleW

user32

GetMonitorInfoA MessageBoxIndirectW GetMonitorInfoW GetQueueStatus

advapi32

RegSetValueExW InitiateSystemShutdownW QueryServiceConfigW ConvertToAutoInheritPrivateObjectSecurity RegisterServiceCtrlHandlerW RegOpenKeyExW RegConnectRegistryW CreatePrivateObjectSecurity NotifyChangeEventLog RegSaveKeyW ObjectDeleteAuditAlarmW CreateServiceA RegQueryValueExA AccessCheckByTypeResultListAndAuditAlarmA EnumServicesStatusA QueryServiceLockStatusW

Name

.text

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

74.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

File Explorer

d53e6eb20d40a10c81e23bd9d6c9ebdf6da3c4620583028def3c517f1db09902

kernel32

user32

advapi32