MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sodinokibi


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695
SHA3-384 hash: 43a7fcad110632fce677e27c0f23e31749b062b63fcec6fd76ca37843a81b066e98def20d4d97a60aa270f9b2970e96f
SHA1 hash: 4d6b8d954af01ff556aecb055f1965063ec3471e
MD5 hash: be926a24f4118fc23f09ce4ecd9ebff0
humanhash: nevada-floor-early-bulldog
File name:4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695.bin.exe
Download: download sample
Signature Sodinokibi
Create hunting rule
File size:118'272 bytes
First seen:2020-08-20 13:03:14 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 56fec9a88b6ed42978005ae707196ea0 (1 x Sodinokibi)
ssdeep 1536:DTKNnkUl4+aWGPV+eQ5YADz4XqRIpSyCX8ICS4AdtO0MoMfvj1zxvPDA:KkojMww5XqREosQMfb1V
Threatray 168 similar samples on MalwareBazaar
TLSH C6C3C022FD5182F3D5D382FA532B2B3B59BFF930241058A6D3520D844F65492FA2BB1B
Reporter Dashowl
Tags:Sodinokibi

Intelligence

File Origin
# of uploads :
1
# of downloads :
828
Origin country :
n/a
Vendor Threat Intelligence
Detection:
REvil
Create hunting rule
Link:
https://www.capesandbox.com/analysis/49139/
Detection(s):
Win.Ransomware.Sodinokibi-7013612-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/441560
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
sodinokibi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695/
Threat name:
Win32.Ransomware.Sodinokibi
Create hunting rule
Status:
Malicious
First seen:
2020-08-20 13:05:06 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iablhdeczmzz2hglinfvmzjytx6dhyhpwq3lzsdjfaaqpf6is2kq._file
Verdict:
malicious
Similar samples:
6f173aec9830677d751097483b2cd8b9a1609886d0c445568b6f52cf9461a668
Sodinokibi
75abf869cc4ac52539fc264b1e7389bc1a7e38259131c87188ceba0067a47d93
Sodinokibi
a784f7697d378cf741a9f93f8011f2680029969b952f501dc18c2c738cd3df52
Sodinokibi
b8d7fb4488c0556385498271ab9fffdf0eb38bb2a330265d9852e3a6288092aa
Sodinokibi
ba5ad1edfdfaecc2becdd7f08922be08b37450556a503e3bd06119ba57facef0
Sodinokibi
baef8bd7b65e121cc517db1868a64faa86219b0a02bbac76f97688208db2f33a
Sodinokibi
c5fb7187fb4eeb1ab4d725febec0c79ec45ae67498fbc2007b00e0cae11c8a02
Sodinokibi
ddf74c11fc2d7aa8e26404ea318b40070e29b49cf977f0ef76b1e04fa2e8f2e7
Sodinokibi
e80810241a2c6991cd3cfc807a62c1392eeed146fc60cb30326a8e3bc6bc284e
Sodinokibi
f4f27a8d8607db742cdc40a1bffe2384f2a3bdeaa4f10c86d0e339f746a00036
Sodinokibi
+ 158 additional samples on MalwareBazaar
Result
Malware family:
sodinokibi
Create hunting rule
Score:
  10/10
Tags:
ransomware persistence family:sodinokibi
Link:
https://tria.ge/reports/200820-8347m8peq2/
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in System32 directory
Modifies service
Sets desktop wallpaper using registry
Enumerates connected drives
Blacklisted process makes network request
Modifies extensions of user files
Sodin,Sodinokibi,REvil
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
REvil
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_revil_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/49139/

Comments