Behavioral task
behavioral1
Sample
2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-18_329b8aaea517a511908683b56446db99_revil.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-18_329b8aaea517a511908683b56446db99_revil
-
Size
126KB
-
MD5
329b8aaea517a511908683b56446db99
-
SHA1
9abe20a9c460a3e530cb96658541c6d25700a529
-
SHA256
c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20
-
SHA512
172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa
-
SSDEEP
1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA
Malware Config
Signatures
-
Sodinokibi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-01-18_329b8aaea517a511908683b56446db99_revil
Files
-
2024-01-18_329b8aaea517a511908683b56446db99_revil.exe windows:5 windows x86 arch:x86
f3d46e2f8717ced6d4b220e65d6ad18a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
lstrcmpiW
Sleep
VerSetConditionMask
VerifyVersionInfoW
lstrcmpA
SetThreadPriority
user32
MessageBoxW
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
Sections
Size: 49KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 78.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ