sodinokibi | a26e215a307069487644e70164a0cd8d69b40b0c[.]rl[.]zip

Reason

config extraction: sodinokibi: invalid character '@' looking for beginning of value

General

Target
a26e215a307069487644e70164a0cd8d69b40b0c.rl.zip
Size 85KB
Sample220128-vyfr7ahbcq
SHA256 2ee68560ea19925f91153c44e1ffacc2c982162fd00f330a0e40647099911b3b
MD5 ecc19d19d6917bfc910071227792dd35
SHA1 b4f5bc9713fd1f7076c06973830d45edf142a98f
SHA512 06a77573da21391e6cc93ab6fc6ea825989e213dcfee106e7fe043f07b9d5bc14b3ef52f2614ab8aa1eb7e244098f15cd77999c102257f16f896daa8d39fd9d0
SSDEEP 1536:kRL5ZPLz3eUZ4yig7ooU+h9YAi+8Nb/Io+LkbH8VWok6IfJ:2lZvOfX6Uc9Yl+kbHy5xIfJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sodinokibi

Sodinokibi/Revil sample 1 IoCs

resource	yara_rule
static1/unpack001/a26e215a307069487644e70164a0cd8d69b40b0c.rl	family_sodinokobi

SHA256 2ee68560ea19925f91153c44e1ffacc2c982162fd00f330a0e40647099911b3b
MD5 ecc19d19d6917bfc910071227792dd35
SHA1 b4f5bc9713fd1f7076c06973830d45edf142a98f
SHA512 06a77573da21391e6cc93ab6fc6ea825989e213dcfee106e7fe043f07b9d5bc14b3ef52f2614ab8aa1eb7e244098f15cd77999c102257f16f896daa8d39fd9d0
SSDEEP 1536:kRL5ZPLz3eUZ4yig7ooU+h9YAi+8Nb/Io+LkbH8VWok6IfJ:2lZvOfX6Uc9Yl+kbHy5xIfJ
MD5 SHA1 SHA512 SSDEEP

Password

infected

SHA256 9a289ae036b2fdac5cf0873095a3578cedc5323d27a9995a9651a5388bcd76f9
MD5 b6f6a416704bcf744096648bb11f829f
SHA1 a26e215a307069487644e70164a0cd8d69b40b0c
SHA512 ed26c1fe5bc0874a4ff7f57f25cc0b3e5cc39162002f53b401c510bdb8fd70c96978c95ae8d364f71af23a92eb40fa97219bd057c9741e529df234b897b871eb
SSDEEP 3072:Fi8Iy8EytSLbi4etMlwDCnyZ3Vzjee5GN3I:U8IUykbnOnZ30eEZI
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

12276

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths