sodinokibi | 2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil | Triage

Sharing

General

Target

2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil
Size

123KB
MD5

e005b6ad501cd8f855c07f47c1946d4b
SHA1

bdfc6d78830076b8943d87e6c4bd8abbe84d8a5a
SHA256

9edc2b6ebf65577aa777c9f7cbe93562d4100698780772d6926e8d4827eb418f
SHA512

b449ca493475c27961b032dd0c4dddc5608bd2656a801f75aca370aaf3522687d99e9890a93fcd1d7eb5f7e3d67dc644c2a738cb006ec0b29b61e991a7758ee8
SSDEEP

1536:7DvcP3LThpshwVs5OE8yNcCQp+2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOxU:y4SVhaNcCM8gnBR5uiV1UvQFOxU

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil

Files

2024-03-09_e005b6ad501cd8f855c07f47c1946d4b_revil
.exe windows:5 windows x86 arch:x86

7ecacfc6f1d64067e0047425ad885408

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenW
SetErrorMode

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.k797i
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.htext
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE