sodinokibi | 2024-02-29_ef22707cc3d3978cd6c373ad87d903c1_revil | Triage

Sharing

General

Target

2024-02-29_ef22707cc3d3978cd6c373ad87d903c1_revil
Size

59KB
MD5

ef22707cc3d3978cd6c373ad87d903c1
SHA1

9461db2db1b479e0603b103a03e1fee0910321fb
SHA256

70cd7cdc9c9773fae3aca0fedf5ca16459ed39a5101363392aa8a66a6e539711
SHA512

7456888d0f75f3865d404327ce846452a46001f458d9607f1e6594f52462d5e4bec7ea69a5f3524948a2ebb5b707e5002aca0c012f6baf244193918cecc03839
SSDEEP

1536:FApx/1k2jbVnO3c+FpR5Q9JzY02pTmZ0ICS4AteM:ck2X8M+Fp4vY06AP

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-02-29_ef22707cc3d3978cd6c373ad87d903c1_revil

Files

2024-02-29_ef22707cc3d3978cd6c373ad87d903c1_revil
.exe windows:5 windows x86 arch:x86

7ecacfc6f1d64067e0047425ad885408

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenW
SetErrorMode

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.g2mpw4
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ