MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d73ce9f8e11bbbce1bec1147bf30ef60a6d362504fbf650b3c8a0ea6f7c4fbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sodinokibi


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d73ce9f8e11bbbce1bec1147bf30ef60a6d362504fbf650b3c8a0ea6f7c4fbb
SHA3-384 hash: cb3b7692894bc627796347d40b0376c61bedfa9628fd17ccf9d63949178b1038c31f39132cc8cec42a9447a5b91bfc3f
SHA1 hash: 5b79dd2791a817e283bc41f6ef3eff42c3b8f131
MD5 hash: 1ff591e2e37178684b73926816ea758c
humanhash: nebraska-wyoming-crazy-summer
File name:sample
Download: download sample
Signature Sodinokibi
Create hunting rule
File size:68'096 bytes
First seen:2020-10-19 18:33:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1e6452b349d3cbc048e72755b22f42e0 (37 x Sodinokibi)
ssdeep 1536:6njEER+AxX+zKxgjUtbWcpjSO/k6ICS4AokLdD:wm+xggtbWYamAd
Threatray 188 similar samples on MalwareBazaar
TLSH 8D638E02BEB04933D41345F617BB3F5689BEBD74083590BBAB649CC90F21991E62B727
Reporter Dashowl
Tags:2.0 Decryptor REvil Sodinokibi

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'991
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/73097/
Detection(s):
Win.Ransomware.Sodinokibi-7013612-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Creating a window
Sending a UDP request
Result
Threat name:
Revil
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/495903
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Multi AV Scanner detection for submitted file
Yara detected Revil
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d73ce9f8e11bbbce1bec1147bf30ef60a6d362504fbf650b3c8a0ea6f7c4fbb/
Threat name:
Win32.Ransomware.Sodinokibi
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 10:25:45 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
602375762d88d24ae659c47d25959e52ed5cea1d227609ec486bd42d551ca009
Sodinokibi
6081e88fe927e60d87da7a0bf1cc748f3c52f951a80dd3e4bd16ceaadc80571a
Sodinokibi
6e5f225b72d932fa68cafd3e0366298d5b1b92098049dcf01f6e3f2ad0f9b92e
Sodinokibi
75175009b6864cf3a0147051272ccf63d8fac7f7a521e32f9d3c69a7acd4866d
Sodinokibi
81b452c5cfc9b054231b73c412e06335770965ec8ec92a309df18c1909233a70
Sodinokibi
8931fa8e5b8ec0db4b1a722778eaaf580ed1a45fc4f93a5e879d688925971424
Sodinokibi
b83081e0e2676da0476f762d0d3efcccf37db54e1fb9ce3b663d4b9557185744
Sodinokibi
b9f3199637a3662429d829e2eb2d210fc96bf282883e721da1704981c136b143
Sodinokibi
bfbe9826927232ab355f0dc6343175dec5244026bdead1ca7033f4ba62d9a65c
Sodinokibi
fd8ba926720610c0864ed8f53bfe61b9d991883798f176f7ad65a16102aeeca3
Sodinokibi
+ 178 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201019-94xnfx59ze/
Unpacked files
SH256 hash:
2d73ce9f8e11bbbce1bec1147bf30ef60a6d362504fbf650b3c8a0ea6f7c4fbb
MD5 hash:
1ff591e2e37178684b73926816ea758c
SHA1 hash:
5b79dd2791a817e283bc41f6ef3eff42c3b8f131
Detections:
win_revil_auto
Create hunting rule
Link:
https://www.unpac.me/results/1c9d3df4-54c0-45b4-bdca-f7be0d3aa907/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
REvil
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d73ce9f8e11bbbce1bec1147bf30ef60a6d362504fbf650b3c8a0ea6f7c4fbb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_revil_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

anyrun
any.run
https://app.any.run/tasks/23acd2ed-96ce-41a1-8341-8ccf3c079ae7
Cape
Cape
https://www.capesandbox.com/analysis/73097/

Comments