sodinokibi | 674ad8128d17418474a2b4615da81c935d4d7f9c[.]rl[.]zip

Reason

config extraction: sodinokibi: invalid character 'î' looking for beginning of value

General

Target
674ad8128d17418474a2b4615da81c935d4d7f9c.rl.zip
Size 88KB
Sample220128-vx68rahbcj
SHA256 f9360028f0313e3bf8b595aa92ddef1b21bd12e4dc79c636a11aaed160ff9b4d
MD5 54f118ad53f6c9451c979305bd1a4793
SHA1 694b03cf276af0a8bf630ab95541870006cca48e
SHA512 685e260221832b608f5787e6f904edb1cc962d22ad98c62cb9786960cb3ffc44a789ade73ddb3ab97deb918e4ec792eabd9a93d284cb2ca660f16af29ab4a7ae
SSDEEP 1536:gZcMVkdE94GZ0EhPNDtzmfmON31rfPcnK2caJ7046RUZSKhTBZErWX9a5XT8gR:54kdE94G9PNDlSm4lrgJnSD2FZy5XAgR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sodinokibi

Sodinokibi/Revil sample 1 IoCs

resource	yara_rule
static1/unpack001/674ad8128d17418474a2b4615da81c935d4d7f9c.rl	family_sodinokobi

SHA256 f9360028f0313e3bf8b595aa92ddef1b21bd12e4dc79c636a11aaed160ff9b4d
MD5 54f118ad53f6c9451c979305bd1a4793
SHA1 694b03cf276af0a8bf630ab95541870006cca48e
SHA512 685e260221832b608f5787e6f904edb1cc962d22ad98c62cb9786960cb3ffc44a789ade73ddb3ab97deb918e4ec792eabd9a93d284cb2ca660f16af29ab4a7ae
SSDEEP 1536:gZcMVkdE94GZ0EhPNDtzmfmON31rfPcnK2caJ7046RUZSKhTBZErWX9a5XT8gR:54kdE94G9PNDlSm4lrgJnSD2FZy5XAgR
MD5 SHA1 SHA512 SSDEEP

Password

infected

SHA256 ae9600cb391f447933e29069ca3000bb61a005d58fe14eb84fd830403221e48f
MD5 9716372508103ef6a050c0de6685c3a1
SHA1 674ad8128d17418474a2b4615da81c935d4d7f9c
SHA512 6738de8f90602772486519971669c96a180d11a523c2870b34e94d93e5c5171769c26459d93cf220b44a6924b01aff485e9e4f1dddc817cb758992575ab62aed
SSDEEP 3072:e27d6J6EYcLbi44TMlwDCnIY2B2JmLvaf:e2Z68E7bnYxnBwcvS
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

13793

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths