Behavioral task
behavioral1
Sample
2023-05-13_c5baecf50164376ef048646969d080d4_revil.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2023-05-13_c5baecf50164376ef048646969d080d4_revil.exe
Resource
win10v2004-20230221-en
General
-
Target
2023-05-13_c5baecf50164376ef048646969d080d4_revil
-
Size
122KB
-
MD5
c5baecf50164376ef048646969d080d4
-
SHA1
610ba6ae85414b12e509e77906d8b81f95ce8cb7
-
SHA256
da5d73f59359d904a6c58c4940270a4ad7774ff340442f7a0eaebd2ccbc7c7fb
-
SHA512
7c8231224b15d43a1129bb5012fb443937f9fd0153ecf223371b2d362bdb0242645655fc573a0be2d260f6629d5b109ba896c18dafbdfa187a8050376d813571
-
SSDEEP
1536:hxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6UdOgYMTLOjeW47s:hMhQNDEtb3AiPnGjeW47s
Malware Config
Signatures
-
Sodinokibi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-05-13_c5baecf50164376ef048646969d080d4_revil
Files
-
2023-05-13_c5baecf50164376ef048646969d080d4_revil.exe windows x86
f3d46e2f8717ced6d4b220e65d6ad18a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
lstrcmpiW
Sleep
VerSetConditionMask
VerifyVersionInfoW
lstrcmpA
SetThreadPriority
user32
MessageBoxW
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.v0rmpw Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ