MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sodinokibi


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9
SHA3-384 hash: af5e77284ac38856091d316e0b4742160a9f6e592f7fabc86551d2543391794b6587225ac00b10784fd5574e41861d1a
SHA1 hash: c8bc0c32a7155e547773d1df419915e5bfffcf2f
MD5 hash: d3808c0b73390ac85758fa35fa7f7f3a
humanhash: cat-eleven-pip-chicken
File name:34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9.bin.exe
Download: download sample
Signature Sodinokibi
Create hunting rule
File size:118'272 bytes
First seen:2020-07-20 18:30:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c686e5b9f7a178eb79f1cf16460b6a18 (3 x Sodinokibi)
ssdeep 1536:/DMcoFQf0U4u//dpkDM5Rw8IP3NHpwOqJICS4A9ObaKt64evCI0slV7L9nUGUb:euDkD+I3NJFqGK04emsfLd5+
Threatray 178 similar samples on MalwareBazaar
TLSH 37C3CF22EC9043F3C99342F2127B2F1B99BEFD34951419F6D32049495E7A483EA1F667
Reporter Dashowl
Tags:Sodinokibi

Intelligence

File Origin
# of uploads :
1
# of downloads :
872
Origin country :
n/a
Vendor Threat Intelligence
Detection:
REvil
Create hunting rule
Link:
https://www.capesandbox.com/analysis/27742/
Detection(s):
Win.Ransomware.Sodinokibi-7013612-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Using the Windows Management Instrumentation requests
Creating a file
Creating a file in the Program Files directory
Creating a file in the Program Files subdirectories
Changing a file
Creating a file in the %AppData% directory
Reading critical registry keys
Creating a file in the %temp% directory
Creating a file in the %AppData% subdirectories
Moving a file to the %temp% directory
Modifying an executable file
Moving a file to the %AppData% subdirectory
Reading Telegram data
Stealing user critical data
Encrypting user's files
Enabling autorun with Startup directory
Result
Threat name:
Sodinokibi
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/391968
Behaviour
Behavior Graph:
Download SVG
Detection:
sodinokibi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9/
Threat name:
Win32.Ransomware.Sodinokibi
Create hunting rule
Status:
Malicious
First seen:
2020-07-14 15:35:17 UTC
AV detection:
27 of 28 (96.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gsubhiibnjybmg3g4aggfdm63w4x5t5hryrhfxrop2dprsmbvhuq._file
Verdict:
malicious
Similar samples:
07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a
Sodinokibi
591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a
Sodinokibi
6f173aec9830677d751097483b2cd8b9a1609886d0c445568b6f52cf9461a668
Sodinokibi
b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb
Sodinokibi
b8d7fb4488c0556385498271ab9fffdf0eb38bb2a330265d9852e3a6288092aa
Sodinokibi
ba5ad1edfdfaecc2becdd7f08922be08b37450556a503e3bd06119ba57facef0
Sodinokibi
bbcaee51155609d365f6bb297d124efea685df0243ec1d4efb5043d9afe5963d
Sodinokibi
cb0373b35abf4b089be60e714ee415d3491ddc2cffcfb45b84a87a3a106c822f
Sodinokibi
e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923
Sodinokibi
fa7d2020776a080d2580c0cad013be84484cbaa8d927fedd51914bad567d3278
Sodinokibi
+ 168 additional samples on MalwareBazaar
Result
Malware family:
sodinokibi
Create hunting rule
Score:
  10/10
Tags:
ransomware family:sodinokibi persistence
Link:
https://tria.ge/reports/200720-a4kp61hv82/
Behaviour
Suspicious use of WriteProcessMemory
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Drops file in Program Files directory
Modifies service
Sets desktop wallpaper using registry
Drops file in System32 directory
Enumerates connected drives
Drops startup file
Sodin,Sodinokibi,REvil
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_revil_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27742/

Comments