Behavioral task
behavioral1
Sample
2024-01-10_358675a3ade890440585b9eb088415fd_revil.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-10_358675a3ade890440585b9eb088415fd_revil.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-10_358675a3ade890440585b9eb088415fd_revil
-
Size
126KB
-
MD5
358675a3ade890440585b9eb088415fd
-
SHA1
ebb2bb2b6c200368e0b0398d1f349094958c8271
-
SHA256
9e40ff88bfd8b5dbdd77a7fd7adfc76ba20e6ebb4c817effcca4e82c5d23429e
-
SHA512
decd60efce81c4a45b5ac6caed55beda78e1256de85a9b12dd3840d542325f0ce4434bbe39b91f7cd25a5b1f85852bff1491ea4ce49f1e618363b5e616800b74
-
SSDEEP
1536:BxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6UdZls8XzUXiWw4X5FD:BMhQNDEtb3AiZHjUyWw4X5FTDUH
Malware Config
Signatures
-
Sodinokibi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-10_358675a3ade890440585b9eb088415fd_revil
Files
-
2024-01-10_358675a3ade890440585b9eb088415fd_revil.exe windows:5 windows x86 arch:x86
f3d46e2f8717ced6d4b220e65d6ad18a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
lstrcmpiW
Sleep
VerSetConditionMask
VerifyVersionInfoW
lstrcmpA
SetThreadPriority
user32
MessageBoxW
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
Sections
Size: 49KB - Virtual size: 54.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 54.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 54.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 50KB - Virtual size: 54.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 54.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ