sodinokibi | 2024-12-15_13e9c0da533f5cd302865cfd625642ae_revil_sodinokibi

Sharing

Copy URL

Twitter E-mail

General

Target

2024-12-15_13e9c0da533f5cd302865cfd625642ae_revil_sodinokibi
Size

143KB
MD5

13e9c0da533f5cd302865cfd625642ae
SHA1

2d6cee5738a1878370513e4b1bba778c9b5d9e0e
SHA256

e6b1e1a882384006dda922e18dc4a8b10e3c7e7e7addc82b82e3f12b497d1875
SHA512

689d2de9140d21562688727bea68056795f60652b445fd282d8dc17addd80889c5ec22690f9c65a0b30e6285fb4f2ffc4fc9a090e16253a2673cd4ff0fe58879
SSDEEP

3072:OJfnP2WgnLbi4eTMlwDCnu/zGB96W/y1cL:s/OWAbnWJ/yB9wcL

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Sodinokibi/Revil sample 1 IoCs

resource	yara_rule
sample	family_sodinokobi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-12-15_13e9c0da533f5cd302865cfd625642ae_revil_sodinokibi

Files

2024-12-15_13e9c0da533f5cd302865cfd625642ae_revil_sodinokibi
.exe windows:5 windows x86 arch:x86

4c84d10323272583b9286a1186a7fe5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfW
ReleaseDC
DrawTextW
SystemParametersInfoW
GetDC
GetForegroundWindow
FillRect
GetKeyboardLayoutList

ntdll

RtlGetLastWin32Error
RtlInitUnicodeString
_snwprintf
NtClose
NtOpenFile
RtlTimeToTimeFields
RtlFreeHeap

winhttp

WinHttpSendRequest
WinHttpSetOption
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpConnect
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpCrackUrl

kernel32

PostQueuedCompletionStatus
CreateToolhelp32Snapshot
OpenMutexW
HeapDestroy
GetDiskFreeSpaceExW
GetUserDefaultUILanguage
LocalFree
GetFileAttributesExW
DeleteFileW
SystemTimeToFileTime
HeapCreate
CreateFileW
CreateIoCompletionPort
GetCurrentProcess
TerminateProcess
InitializeCriticalSection
CreateFileMappingW
MapViewOfFile
CompareFileTime
LeaveCriticalSection
GetFileSize
DeleteCriticalSection
OpenProcess
GlobalFree
CreateThread
WaitForSingleObject
LocalAlloc
Wow64RevertWow64FsRedirection
VirtualAlloc
Wow64DisableWow64FsRedirection
GetCommandLineW
GetModuleFileNameW
GetSystemInfo
GetQueuedCompletionStatus
SetFileAttributesW
WriteFile
Process32NextW
MulDiv
GetFileSizeEx
MoveFileW
MultiByteToWideChar
ReadFile
UnmapViewOfFile
GetComputerNameW
GetCurrentProcessId
FindNextFileW
GetTempPathW
GetProcessHeap
SetErrorMode
EnterCriticalSection
HeapAlloc
FindFirstFileW
SetFilePointerEx
GetSystemDefaultUILanguage
ExitProcess
GlobalAlloc
GetDriveTypeW
GetNativeSystemInfo
FindClose
CloseHandle
ReleaseMutex
Sleep
GetProcAddress
Process32FirstW
WideCharToMultiByte
GetVolumeInformationW
CreateMutexW
GetSystemDirectoryW
GetFileAttributesW
GetWindowsDirectoryW

advapi32

RegQueryValueExW
ImpersonateLoggedOnUser
CryptAcquireContextW
AllocateAndInitializeSid
IsValidSid
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
GetUserNameW
OpenProcessToken
RevertToSelf
GetTokenInformation
FreeSid
CryptGenRandom
CheckTokenMembership
RegCloseKey

ole32

CreateStreamOnHGlobal

mpr

WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW

shlwapi

SHDeleteKeyW
PathFindExtensionW
SHDeleteValueW

gdi32

GetObjectW
SetBkMode
GetDeviceCaps
GetStockObject
DeleteDC
GetDIBits
SelectObject
CreateCompatibleBitmap
SetBkColor
DeleteObject
SetTextColor
CreateCompatibleDC
SetPixel
CreateFontW

crypt32

CryptBinaryToStringW
CryptStringToBinaryW

winmm

timeBeginPeriod
timeGetTime

shell32

CommandLineToArgvW
ShellExecuteExW

Sections

.text
Size: 41KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.s7bz
Size: 26KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.SCY
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4c84d10323272583b9286a1186a7fe5a

Headers

DLL Characteristics

File Characteristics

Imports

user32

ntdll

winhttp

kernel32

advapi32

ole32

mpr

shlwapi

gdi32

crypt32

winmm

shell32

Sections

.text Size: 41KB - Virtual size: 44KB

.rdata Size: 62KB - Virtual size: 64KB

.data Size: 5KB - Virtual size: 8KB

.s7bz Size: 26KB - Virtual size: 52KB

.reloc Size: 1KB - Virtual size: 4KB

.SCY Size: 6KB - Virtual size: 8KB

.text
Size: 41KB - Virtual size: 44KB

.rdata
Size: 62KB - Virtual size: 64KB

.data
Size: 5KB - Virtual size: 8KB

.s7bz
Size: 26KB - Virtual size: 52KB

.reloc
Size: 1KB - Virtual size: 4KB

.SCY
Size: 6KB - Virtual size: 8KB