sodinokibi | 2024-06-13_284b4e74f0f243790550b6a20084cff5_revil | Triage

Sharing

General

Target

2024-06-13_284b4e74f0f243790550b6a20084cff5_revil
Size

123KB
MD5

284b4e74f0f243790550b6a20084cff5
SHA1

c1d87ee231516181ca6ca3921cf6578f2cf872d4
SHA256

7295707af6aaac77d6dea7d30c96077045fb623645fb493fcb419bc80d4f57db
SHA512

b9d83b25b74ca0316901f3cb83ebf9ce37256af0e798756cb12b0dff7ad6174594e062ba09920f23bc28d91e8f0c3830b777916e0ba3707b6c15389c4d94d052
SSDEEP

1536:2DvcP3LThpshwVs5OE8yNcY/p+2ZZICS4AnjnBR561lQVMr3IgmffEbjQFOxw:B4SVhaNcYh81nBR5uiV1UvQFOxw

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_284b4e74f0f243790550b6a20084cff5_revil

Files

2024-06-13_284b4e74f0f243790550b6a20084cff5_revil
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.k797i
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.htext
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE