Behavioral task
behavioral1
Sample
2023-02-08_d3624ff1fd9a8d7866a1578359716a55_revil_sodinokibi.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2023-02-08_d3624ff1fd9a8d7866a1578359716a55_revil_sodinokibi.exe
Resource
win10v2004-20221111-en
General
-
Target
2023-02-08_d3624ff1fd9a8d7866a1578359716a55_revil_sodinokibi.exe
-
Size
179KB
-
MD5
d3624ff1fd9a8d7866a1578359716a55
-
SHA1
66813f8263a1c8a53e8d6fece8a307e2ba5fa342
-
SHA256
60c49baa290de5336e5903286d1e8ff8b8b833046a63be00966695dc9d3f6dbb
-
SHA512
97da304352f0a37071ae935879af3531e33dd580e50f768521e2e12986f155d7a1b09e755cef20f720f3e9bb9608258e2fd37f32e5aca5cf611cfa4dfa8e0ee9
-
SSDEEP
3072:rNKQ4JTBg0Q8F63VETed7/kBazzFbUL7npOStSWQ:rNn4FQS63VE6F/M4q30TJ
Malware Config
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
2023-02-08_d3624ff1fd9a8d7866a1578359716a55_revil_sodinokibi.exe.exe windows x86
9014e39262404e977fd8e4e75cce30e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
SetErrorMode
GetStdHandle
CreateFileW
WriteFile
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
GetCurrentThread
GetProcAddress
SetThreadAffinityMask
lstrlenW
LoadLibraryA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleW
IsProcessorFeaturePresent
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kmh Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ