sodinokibi | 2024-06-13_414f91c122419b70e1f147766743e6de_revil | Triage

Sharing

General

Target

2024-06-13_414f91c122419b70e1f147766743e6de_revil
Size

116KB
MD5

414f91c122419b70e1f147766743e6de
SHA1

9f34a6caf3efd66408c405c8b86c58be9e52899f
SHA256

04415c4746b7c85913c424ff1ea71ecf9bb3c42dcbd370742afc0420662492fe
SHA512

eeeeb81d9eff95ce32fa594ccd6f2804824b214660ac866c468ac8122414974f8455181e3d2fade151c40e4ee94e64ed101adf60fd8a148f1bb356f7f8a0686d
SSDEEP

1536:KIlhrm++mJ0eYjT7LUrACph77pS2i/ICS4AcMvtshCaRzZOEJ21pRA:4fcrh7tJPvqhpZZOEj

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_414f91c122419b70e1f147766743e6de_revil

Files

2024-06-13_414f91c122419b70e1f147766743e6de_revil
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cfg
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ