sodinokibi | e86a6b6140b3caa0f022b617f145e96f[.]bin

General

Target
e86a6b6140b3caa0f022b617f145e96f.bin
Size 37KB
Sample230307-cdfycaga4t
SHA256 61821256c0b845ac3ef1c0dff06052b89d52b1884dcf70da7d187b6963c3527a
MD5 064fd9d179f139aecd4e85dff81bfcb6
SHA1 45deaaddb5b6d64e4cb9101b1b5f2b1fea10d931
SHA512 09c76a80586456726ddf2e6e9a30e41cb4c9152fea6a6c5c12f9a1de710a7b81335706397ffacee8be69f7956c1fb96ac2d03f66698a2edacee0afff692db5b8
SSDEEP 768:+nXi9qoMgiNUFb+Iy8AQjrg2K47cgjUJVv+yP5aGz1obwE:+8pIQSb8Ln/cgjUz+yP5aGZoME
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Sodinokibi/Revil sample 1 IoCs

resource	yara_rule
static1/unpack001/b88951ceb296c8f01a8e13bc4efa4eb754361ee8ad3d64063d14489bc139a492.exe	family_sodinokobi

File Explorer

e86a6b6140b3caa0f022b617f145e96f.bin

.zip 37KB
b88951ceb296c8f01a8e13bc4efa4eb754361ee8ad3d64063d14489bc139a492.exe

.exe 111KB

e86a6b6140b3caa0f022b617f145e96f.bin

SHA256 61821256c0b845ac3ef1c0dff06052b89d52b1884dcf70da7d187b6963c3527a
MD5 064fd9d179f139aecd4e85dff81bfcb6
SHA1 45deaaddb5b6d64e4cb9101b1b5f2b1fea10d931
SHA512 09c76a80586456726ddf2e6e9a30e41cb4c9152fea6a6c5c12f9a1de710a7b81335706397ffacee8be69f7956c1fb96ac2d03f66698a2edacee0afff692db5b8
SSDEEP 768:+nXi9qoMgiNUFb+Iy8AQjrg2K47cgjUJVv+yP5aGz1obwE:+8pIQSb8Ln/cgjUz+yP5aGZoME
MD5 SHA1 SHA512 SSDEEP

Password

infected

b88951ceb296c8f01a8e13bc4efa4eb754361ee8ad3d64063d14489bc139a492.exe

IMPHASH 1da9bd2a660139c2d8ce0baa10e11ec5
SHA256 b88951ceb296c8f01a8e13bc4efa4eb754361ee8ad3d64063d14489bc139a492
MD5 e86a6b6140b3caa0f022b617f145e96f
SHA1 7e0586498743aa426b642e9997cf321668fc22e9
SHA512 38512bba6a35caba0685a142cca2d2af6d822050af572eabe0970f5b33e0edae02dd7bd97a352b1deb3c78713c5cb4f5e8273862959157a13ace5cc58c1c73ce
SSDEEP 1536:vxmFqbN+uJ+GayuAELVWwPALp1qSdkqICS4A7Wk6t:52quxA9GtW9
MD5 SHA1 SHA512 SSDEEP

windows x86

Sodinokibi/Revil sample

Password

infected

Minor OS version

Major OS version

Entry point

7644

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.hjl

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

e86a6b6140b3caa0f022b617f145e96f.bin

b88951ceb296c8f01a8e13bc4efa4eb754361ee8ad3d64063d14489bc139a492.exe

kernel32

user32

gdi32

Sharing

General

Malware Config

Signatures

File Explorer

e86a6b6140b3caa0f022b617f145e96f.bin

b88951ceb296c8f01a8e13bc4efa4eb754361ee8ad3d64063d14489bc139a492.exe

kernel32

user32

gdi32