MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Sodinokibi

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95
SHA3-384 hash:	735167cbfe632d2ccaafa8928415ce2355cf35f152eecbe6bffc1cfdcd4ab27b556a9104f344869bd34302d89a54cd1e
SHA1 hash:	24e8a7a0b9fdf929e6cc4b52b0470bf4f7b6f244
MD5 hash:	0e285f30f30dedd812295d2408f4b84c
humanhash:	charlie-spring-india-robert
File name:	d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95.bin
Download:	download sample
Signature	Sodinokibi Create hunting rule
File size:	120'832 bytes
First seen:	2020-11-22 00:02:25 UTC
Last seen:	2021-08-13 08:55:14 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3eff7b78fa879bdd7bc10b8b899e0ab3 (1 x Sodinokibi)
ssdeep	1536:ac79OtHXciw8MfMNQulioPIKNpVO6OICS4AziU/U/F20rg8sNlQoaA:EXCSK4IKvXhiU/+F20EVlQTA
Threatray	193 similar samples on MalwareBazaar
TLSH	08C3C033B9A042F3CC9306F7131B2F3F9ABFBE345514A836D76089845A265939627367
Reporter	Arkbird_SOLG
Tags:	REvil Sodinokibi

Intelligence

File Origin

# of uploads :

# of downloads :

2'032

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Using the Windows Management Instrumentation requests

Creating a file

Launching a service

Launching a process

Creating a file in the Windows subdirectories

Reading critical registry keys

Changing a file

Blocking Windows Firewall launch

Stealing user critical data

Creating a file in the mass storage device

Forced shutdown of a browser

Encrypting user's files

Result

Threat name:

Sodinokibi

Detection:

malicious

Classification:

rans.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/544659

Signature

Antivirus / Scanner detection for submitted sample

Contains functionality to detect sleep reduction / modifications

Found malware configuration

Found ransom note / readme

Found Tor onion address

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Multi AV Scanner detection for submitted file

Yara detected Sodinokibi Ransomware

Behaviour

Behavior Graph:

Download SVG

Detection:

sodinokibi

Link:

https://mwdb.cert.pl/sample/d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95/

Threat name:

Win32.Ransomware.Sodinokibi

Status:

Malicious

First seen:

2020-11-21 21:42:58 UTC

File Type:

PE (Exe)

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3epzkg646nibfldli7biz4zoyfb6ijusipmmekpwzmzg7u2d36kq._file

Verdict:

malicious

Sodinokibi

2c5748124b8609d1cf71a44d77177c9a92bca21f9d9be9c487fdaf6072500f15

Sodinokibi

6295da1218817aaac71447d83d2221d251724dd33751d94581e3f10e76da1280

Sodinokibi

8c716101e118ac65d7bdb900e0100d012256abb1d7cdf64830e5943a795ccce2

Sodinokibi

8d1e4bb75799fd3639d12f2418ae31631e483f8dd9758e1e8ba785c4e7a18a71

Sodinokibi

9793e0ba85d2b0c14960b6cc506fe2aecb952795e167d504e2701b4dd399dbb6

Sodinokibi

b8fcf275ea5024bc10bd51f4db8f59d01822b9ec61e7a5ada8bf6290954933b2

Sodinokibi

e0b8bc41f54e982571d878303f3714a2b71985e37abe8f2c84c04139927b31a9

Sodinokibi

e12e9ff0a4cf29714bed618d69ff121b8a8d269d741cc1dbc8d92b9a405716a0

Sodinokibi

e3e37c5cf4b43ea92fd71e08edc38bcfe6fe33f283f62aa5632113c444a71b00

Sodinokibi

+ 183 additional samples on MalwareBazaar

Result

Malware family:

sodinokibi

Score:

10/10

Tags:

family:sodinokibi persistence ransomware

Link:

https://tria.ge/reports/201122-1sj4vjn3fa/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Drops file in Program Files directory

Modifies service

Sets desktop wallpaper using registry

Enumerates connected drives

Modifies extensions of user files

Sodin,Sodinokibi,REvil

Unpacked files

SH256 hash:

d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95

MD5 hash:

0e285f30f30dedd812295d2408f4b84c

SHA1 hash:

24e8a7a0b9fdf929e6cc4b52b0470bf4f7b6f244

Detections:

win_revil_auto

Link:

https://www.unpac.me/results/f3529798-50f6-4f4e-b798-0331ee8abc5d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

REvil

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_revil_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator