sodinokibi | 2024-06-11_9946fd81a0ec0c04a4c232f5f8084d48_revil | Triage

Sharing

General

Target

2024-06-11_9946fd81a0ec0c04a4c232f5f8084d48_revil
Size

92KB
MD5

9946fd81a0ec0c04a4c232f5f8084d48
SHA1

0b9ce6d229b092de0d1cd31213bd4e8cc70cff6a
SHA256

67b2fc312326e8355f1bce26f67087a6cd738cde7aab8eca151f0511b68d5bdc
SHA512

f0a263535f522aa4968eff5c212494efb918e027a913d15391af59aa285966012754be396a5ab7602e7bd452218b4ff9af84c246229593c3ec9abf7faf5a9c75
SSDEEP

1536:t73nkB0DyMgQSm9NwcKzwpR+7JICS4AH11SujG:t/hKzstR1p

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-11_9946fd81a0ec0c04a4c232f5f8084d48_revil

Files

2024-06-11_9946fd81a0ec0c04a4c232f5f8084d48_revil
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ