Behavioral task
behavioral1
Sample
2024-06-12_2064ef527e12bcbe467ba9148dd5b907_revil_sodinokibi.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-12_2064ef527e12bcbe467ba9148dd5b907_revil_sodinokibi.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-12_2064ef527e12bcbe467ba9148dd5b907_revil_sodinokibi
-
Size
156KB
-
MD5
2064ef527e12bcbe467ba9148dd5b907
-
SHA1
30f495e281ecfcf95f1bebde8c9d8e486c14a2ed
-
SHA256
c5815fb72035e77992ae38151ce02635ec21ef53c44c22403b6c426bc6695025
-
SHA512
ecc284817cdcc8ce975f1bee977f67c9ae60e2c3d4b3efe51353fc43f5f4ca19f0fde5412b0fab83c46f23fc5d0ac0f115e3389cd60d78a2825502e8b6a4f35b
-
SSDEEP
1536:LVlo4vFAPi8hnuy8Ey7pAe3U7Pbi4eTMluxtXDCntTnICS4A33eKWKOgwoAN61Vj:Ui8Iy8EytSLbi4eTMlwDCnuZ3N9w0IE
Malware Config
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
resource yara_rule sample family_sodinokobi -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-12_2064ef527e12bcbe467ba9148dd5b907_revil_sodinokibi
Files
-
2024-06-12_2064ef527e12bcbe467ba9148dd5b907_revil_sodinokibi.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.grrr Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE