sodinokibi | 2024-12-15_28b37382562ff548dade7df010148e9c_revil_sodinokibi

Sharing

Copy URL

Twitter E-mail

General

Target

2024-12-15_28b37382562ff548dade7df010148e9c_revil_sodinokibi
Size

143KB
MD5

28b37382562ff548dade7df010148e9c
SHA1

d1300a4df9bd59313cce3ac0f710469c20414f5c
SHA256

f5c11f20320dfc1be95d715260880695bc3e0fc76cc19664b3d6129c57fc80f7
SHA512

94341965eda9c5e3fc1489930153dfd4cf52fa60546386c58513c2a2759f742e778a19188e8fab4dfad1812486133cfc03f541f42b359596fabc5acd2552c1ea
SSDEEP

3072:+p2slWJdWzGLbi4eTMlwDCnu/EGB96W/y1cL:Y7QdWabnWJ/9B9wcL

Score

10^/10

sodinokibi

Malware Config

Signatures

Sodinokibi family
sodinokibi

Sodinokibi/Revil sample 1 IoCs

resource	yara_rule
sample	family_sodinokobi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-12-15_28b37382562ff548dade7df010148e9c_revil_sodinokibi

Files

2024-12-15_28b37382562ff548dade7df010148e9c_revil_sodinokibi
.exe windows:5 windows x86 arch:x86

4c84d10323272583b9286a1186a7fe5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfW
ReleaseDC
DrawTextW
SystemParametersInfoW
GetDC
GetForegroundWindow
FillRect
GetKeyboardLayoutList

ntdll

RtlGetLastWin32Error
RtlInitUnicodeString
_snwprintf
NtClose
NtOpenFile
RtlTimeToTimeFields
RtlFreeHeap

winhttp

WinHttpSendRequest
WinHttpSetOption
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpConnect
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpCrackUrl

kernel32

PostQueuedCompletionStatus
CreateToolhelp32Snapshot
OpenMutexW
HeapDestroy
GetDiskFreeSpaceExW
GetUserDefaultUILanguage
LocalFree
GetFileAttributesExW
DeleteFileW
SystemTimeToFileTime
HeapCreate
CreateFileW
CreateIoCompletionPort
GetCurrentProcess
TerminateProcess
InitializeCriticalSection
CreateFileMappingW
MapViewOfFile
CompareFileTime
LeaveCriticalSection
GetFileSize
DeleteCriticalSection
OpenProcess
GlobalFree
CreateThread
WaitForSingleObject
LocalAlloc
Wow64RevertWow64FsRedirection
VirtualAlloc
Wow64DisableWow64FsRedirection
GetCommandLineW
GetModuleFileNameW
GetSystemInfo
GetQueuedCompletionStatus
SetFileAttributesW
WriteFile
Process32NextW
MulDiv
GetFileSizeEx
MoveFileW
MultiByteToWideChar
ReadFile
UnmapViewOfFile
GetComputerNameW
GetCurrentProcessId
FindNextFileW
GetTempPathW
GetProcessHeap
SetErrorMode
EnterCriticalSection
HeapAlloc
FindFirstFileW
SetFilePointerEx
GetSystemDefaultUILanguage
ExitProcess
GlobalAlloc
GetDriveTypeW
GetNativeSystemInfo
FindClose
CloseHandle
ReleaseMutex
Sleep
GetProcAddress
Process32FirstW
WideCharToMultiByte
GetVolumeInformationW
CreateMutexW
GetSystemDirectoryW
GetFileAttributesW
GetWindowsDirectoryW

advapi32

RegQueryValueExW
ImpersonateLoggedOnUser
CryptAcquireContextW
AllocateAndInitializeSid
IsValidSid
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
GetUserNameW
OpenProcessToken
RevertToSelf
GetTokenInformation
FreeSid
CryptGenRandom
CheckTokenMembership
RegCloseKey

ole32

CreateStreamOnHGlobal

mpr

WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW

shlwapi

SHDeleteKeyW
PathFindExtensionW
SHDeleteValueW

gdi32

GetObjectW
SetBkMode
GetDeviceCaps
GetStockObject
DeleteDC
GetDIBits
SelectObject
CreateCompatibleBitmap
SetBkColor
DeleteObject
SetTextColor
CreateCompatibleDC
SetPixel
CreateFontW

crypt32

CryptBinaryToStringW
CryptStringToBinaryW

winmm

timeBeginPeriod
timeGetTime

shell32

CommandLineToArgvW
ShellExecuteExW

Sections

.text
Size: 41KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.s7bz
Size: 26KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.SCY
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4c84d10323272583b9286a1186a7fe5a

Headers

DLL Characteristics

File Characteristics

Imports

user32

ntdll

winhttp

kernel32

advapi32

ole32

mpr

shlwapi

gdi32

crypt32

winmm

shell32

Sections

.text Size: 41KB - Virtual size: 44KB

.rdata Size: 62KB - Virtual size: 64KB

.data Size: 5KB - Virtual size: 8KB

.s7bz Size: 26KB - Virtual size: 52KB

.reloc Size: 1KB - Virtual size: 4KB

.SCY Size: 6KB - Virtual size: 8KB

.text
Size: 41KB - Virtual size: 44KB

.rdata
Size: 62KB - Virtual size: 64KB

.data
Size: 5KB - Virtual size: 8KB

.s7bz
Size: 26KB - Virtual size: 52KB

.reloc
Size: 1KB - Virtual size: 4KB

.SCY
Size: 6KB - Virtual size: 8KB