🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sodinokibi


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c
SHA3-384 hash: 3f6112b6f46d0874082d41c901542a5ad322f6c6a812748d0ba9876d9456aa27e19cedd202fa1aa0d248b6d58b901781
SHA1 hash: 408cfabc99c350ad28def5475cfff5dc2de02543
MD5 hash: 20defcd42cabf5da27a21dd342e58068
humanhash: mirror-foxtrot-carbon-nitrogen
File name:test9.exe
Download: download sample
Signature Sodinokibi
Create hunting rule
File size:332'288 bytes
First seen:2020-09-17 19:36:24 UTC
Last seen:2020-09-17 20:41:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9dfc091681e3273c01cb816e0516e1d8 (1 x Sodinokibi)
ssdeep 6144:uhHmIZ1A3Lp5r8Xjv0PZNVhmN7r6PNkr1UT:iHdA3Lp5YzIH7mNyFqo
TLSH 7864D0277AF74AF5E26028790D09B65589FBB9933F185192E3A21F4C097DFE10F4831A
Reporter Dashowl
Tags:Ransomware REvil Sodinokibi

Intelligence

File Origin
# of uploads :
2
# of downloads :
2'066
Origin country :
n/a
Vendor Threat Intelligence
Detection:
REvil
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63017/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

MiscreantPunch.SingleXOR.EXE.123.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Sending a UDP request
Launching a process
Using the Windows Management Instrumentation requests
Modifying a system file
Creating a file in the Windows subdirectories
Launching a service
Creating a file in the Program Files directory
Creating a file in the Program Files subdirectories
Changing a file
Moving a recently created file
Reading critical registry keys
Blocking Windows Firewall launch
Stealing user critical data
Creating a file in the mass storage device
Encrypting user's files
Result
Threat name:
Sodinokibi
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/467501
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to inject code into remote processes
Encrypted powershell cmdline option found
Found malware configuration
Found ransom note / readme
Found Tor onion address
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Sigma detected: Delete Shadow Copy Via Powershell
Tries to resolve many domain names, but no domain seems valid
Yara detected Sodinokibi Ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
sodinokibi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c/
Threat name:
Win32.Ransomware.Sodinokibi
Create hunting rule
Status:
Malicious
First seen:
2020-09-16 08:37:26 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Verdict:
malicious
Result
Malware family:
sodinokibi
Create hunting rule
Score:
  10/10
Tags:
ransomware persistence family:sodinokibi
Link:
https://tria.ge/reports/200917-fybh6qzn4a/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Modifies service
Sets desktop wallpaper using registry
Enumerates connected drives
Modifies extensions of user files
Sodin,Sodinokibi,REvil
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
REvil
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_revil_a0
Create hunting rule
Author:BYEMAN
Description:detects UPX-packed and unpacked versions of REvil/Sodinokibi ransomware
Rule name:win_revil_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/63017/

Comments