MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sodinokibi


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a
SHA3-384 hash: 22883c75c34218b60b5c931953a96298def6ac3a12044f1f7e21889ec6f14cd34f98bba48c05db03cb6e3395d343e021
SHA1 hash: 792e99fd481616525c1b6f3f9835e8e24c0f4684
MD5 hash: e9fc1bb19a3765d82f778e88f82593c1
humanhash: hotel-wisconsin-oklahoma-single
File name:07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a
Download: download sample
Signature Sodinokibi
Create hunting rule
File size:118'272 bytes
First seen:2020-06-29 07:43:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ebe3ad33ab366a8155bb7b925b7874ca (2 x Sodinokibi)
ssdeep 1536:ck8UL5PbQCu5Nn/HDM5Oo0mjSpUCBMdqICS4AeNf1Wcr/1OOIZSHrjW4qDPjxPhi:eVvpXmjmYdJ4Z1gYrBqDrhhsb
Threatray 172 similar samples on MalwareBazaar
TLSH 8DC3CF23FD9182F3D99341F6132F6F179ABEBE38141518FBC3204D891E6A482E61B657
Reporter JAMESWT_WT
Tags:Sodinokibi

Intelligence

File Origin
# of uploads :
1
# of downloads :
849
Origin country :
n/a
Vendor Threat Intelligence
Detection:
REvil
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15881/
Detection(s):
Win.Ransomware.Sodinokibi-7013612-0
Create hunting rule

Detection:
sodinokibi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a/
Threat name:
Win32.Ransomware.Sodinokibi
Create hunting rule
Status:
Malicious
First seen:
2020-06-24 03:34:26 UTC
File Type:
PE (Exe)
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9
Sodinokibi
591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a
Sodinokibi
6f173aec9830677d751097483b2cd8b9a1609886d0c445568b6f52cf9461a668
Sodinokibi
b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb
Sodinokibi
b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f
Sodinokibi
ba5ad1edfdfaecc2becdd7f08922be08b37450556a503e3bd06119ba57facef0
Sodinokibi
bbcaee51155609d365f6bb297d124efea685df0243ec1d4efb5043d9afe5963d
Sodinokibi
cb0373b35abf4b089be60e714ee415d3491ddc2cffcfb45b84a87a3a106c822f
Sodinokibi
e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923
Sodinokibi
fa7d2020776a080d2580c0cad013be84484cbaa8d927fedd51914bad567d3278
Sodinokibi
+ 162 additional samples on MalwareBazaar
Result
Malware family:
sodinokibi
Create hunting rule
Score:
  10/10
Tags:
ransomware evasion spyware trojan family:sodinokibi persistence
Link:
https://tria.ge/reports/200629-nyq3k7pfs2/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Sets desktop wallpaper using registry
Drops file in System32 directory
Modifies service
Modifies system certificate store
Adds Run entry to start application
Enumerates connected drives
Sodin,Sodinokibi,REvil
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_revil_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15881/

Comments