MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8d7fb4488c0556385498271ab9fffdf0eb38bb2a330265d9852e3a6288092aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sodinokibi


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8d7fb4488c0556385498271ab9fffdf0eb38bb2a330265d9852e3a6288092aa
SHA3-384 hash: 10e2c6ee9a50866f4f5efa1846cdf17da008e908a5eca70b993abbaf70860a11814f620351f5bd196fa0fec086135e44
SHA1 hash: e5d8d5eecf7957996485cbc1cdbead9221672a1a
MD5 hash: 4d84641b65d8bb6c3ef03bf59434242d
humanhash: pennsylvania-comet-juliet-carbon
File name:4D84641B65D8BB6C3EF03BF59434242D.bin
Download: download sample
Signature Sodinokibi
Create hunting rule
File size:118'272 bytes
First seen:2020-06-22 07:22:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c686e5b9f7a178eb79f1cf16460b6a18 (3 x Sodinokibi)
ssdeep 1536:/DMcoFQf0U4u//dpkDM5Rw8IP3NHpwOqJICS4A9On359M0fLEd2xmjo:euDkD+I3NJFqnjPLEd2xq
Threatray 176 similar samples on MalwareBazaar
TLSH 27C3C062FD9082F3D55341F2122F3F1B99BEFD74641818A7D36089884F76493AA1F663
Reporter JAMESWT_WT
Tags:Sodinokibi

Intelligence

File Origin
# of uploads :
1
# of downloads :
980
Origin country :
n/a
Vendor Threat Intelligence
Detection:
REvil
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12425/
Detection(s):
Win.Ransomware.Sodinokibi-7013612-0
Create hunting rule

Detection:
sodinokibi
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b8d7fb4488c0556385498271ab9fffdf0eb38bb2a330265d9852e3a6288092aa/
Threat name:
Win32.Ransomware.Sodinokibi
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 21:39:23 UTC
File Type:
PE (Exe)
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
2d7f9d04c5f1764ae45a4e2ec4100cf20c51099431135745aaa074c7117cc4a5
Sodinokibi
34a813a1016a70161b66e00c628d9eddb97ecfa78e2272de2e7e86f8c981a9e9
Sodinokibi
4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695
Sodinokibi
591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a
Sodinokibi
6f173aec9830677d751097483b2cd8b9a1609886d0c445568b6f52cf9461a668
Sodinokibi
b433aaa86cc70ce6c60798f07fa013f4712947b32b6692bc08e1832dc17f90fb
Sodinokibi
ba5ad1edfdfaecc2becdd7f08922be08b37450556a503e3bd06119ba57facef0
Sodinokibi
bbcaee51155609d365f6bb297d124efea685df0243ec1d4efb5043d9afe5963d
Sodinokibi
cb0373b35abf4b089be60e714ee415d3491ddc2cffcfb45b84a87a3a106c822f
Sodinokibi
fa7d2020776a080d2580c0cad013be84484cbaa8d927fedd51914bad567d3278
Sodinokibi
+ 166 additional samples on MalwareBazaar
Result
Malware family:
sodinokibi
Create hunting rule
Score:
  10/10
Tags:
ransomware family:sodinokibi persistence
Link:
https://tria.ge/reports/200624-pdt44nqn6x/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Drops file in Program Files directory
Sets desktop wallpaper using registry
Modifies service
Enumerates connected drives
Sodin,Sodinokibi,REvil
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_revil_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/12425/

Comments