9c8c0006666d8294427a2e917a0085b75ac4f6f6e30b25fd96327280f346a089

Classification: Malicious

9c8c0006666d8294427a2e917a0085b75ac4f6f6e30b25fd96327280f346a089 is a ransomware (Windows executable, 166.5 KB). Linked to Revil malware.

Detection summary

  • 95 antivirus detections (76% detection ratio)
  • 1 IDS alerts
  • 2 processes observed
  • 32 contacted hosts
  • 32 DNS requests

MITRE ATT&CK associations

Malware families: REVIL (S0496)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
DeepScan:Generic.Ransom.Sodinokibi Hybrid-Analysis 2020-03-31 13:30:15 2020-03-31 13:30:15 S0496 REvil

Tags

ransomware

Sample information

Filenames
296a7521448fb5ab221c211b84a9eb68
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
170500 bytes
MD5
296a7521448fb5ab221c211b84a9eb68
SHA-1
86fe578673596776c019e21e5a8db63e0943d771
SHA-256
9c8c0006666d8294427a2e917a0085b75ac4f6f6e30b25fd96327280f346a089
First indexed
2020-03-31 13:30:15
Last updated
2026-10-03 13:41:56

Antivirus detections

EngineDetection
BkavW32.AIDetectVM.malware2
MicroWorld-eScanDeepScan:Generic.Ransom.Sodinokibi.72827B62
FireEyeGeneric.mg.296a7521448fb5ab
Qihoo-360Trojan.Generic
ALYacTrojan.Ransom.Sodinokibi
CylanceUnsafe
ZillyaTrojan.Filecoder.Win32.12880
K7AntiVirusTrojan ( 0054d99c1 )
AlibabaRansom:Win32/generic.ali2000010
K7GWTrojan ( 0054d99c1 )
Cybereasonmalicious.1448fb
ArcabitDeepScan:Generic.Ransom.Sodinokibi.72827B62
TrendMicroRansom.Win32.SODINOKIB.SMTH
SymantecML.Attribute.HighConfidence
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Ransomware.Sodinokibi-7013612-0
KasperskyHEUR:Trojan-Ransom.Win32.Gen.gen
BitDefenderDeepScan:Generic.Ransom.Sodinokibi.72827B62
NANO-AntivirusVirus.Win32.Gen.ccmw
AegisLabTrojan.Win32.Gen.j!c
RisingRansom.Sodin!8.10CD8 (CLOUD)
Ad-AwareDeepScan:Generic.Ransom.Sodinokibi.72827B62
EmsisoftDeepScan:Generic.Ransom.Sodinokibi.72827B62 (B)
F-SecureTrojan.TR/Crypt.XPACK.Gen
DrWebTrojan.Encoder.28004
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.Generic.cc
FortinetW32/Sodinokibi.B!tr.ransom
Trapminemalicious.high.ml.score
SophosMal/Generic-S
SentinelOneDFI - Malicious PE
JiangminTrojan.Crypmod.xi
AviraTR/Crypt.XPACK.Gen
MAXmalware (ai score=86)
Antiy-AVLTrojan[Ransom]/Win32.Crypmod
Endgamemalicious (high confidence)
MicrosoftRansom:Win32/Sodinokibi.AB
ZoneAlarmHEUR:Trojan-Ransom.Win32.Gen.gen
AhnLab-V3Trojan/Win32.BlueCrab.C4039859
Acronissuspicious
McAfeeRansom-Sodnkibi!296A7521448F
VBA32BScope.Trojan.DelShad
MalwarebytesRansom.Sodinokibi
ESET-NOD32a variant of Win32/Filecoder.Sodinokibi.B
TrendMicro-HouseCallRansom.Win32.SODINOKIB.SMTH
TencentWin32.Trojan.Filecoder.Hrpi
YandexTrojan.Filecoder!RuqQBHX0/94
IkarusTrojan-Ransom.Sodinokibi
eGambitUnsafe.AI_Score_96%
GDataDeepScan:Generic.Ransom.Sodinokibi.72827B62
BitDefenderThetaGen:NN.ZexaF.34104.kuX@aSmrSfb
AVGWin32:Trojan-gen
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureTrojan.Malware.300983.susgen
AVGWin32:CVE-2018-8453-C [Expl]
AhnLab-V3Trojan/Win32.BlueCrab.R360960
Antiy-AVLTrojan[Ransom]/Win32.Sodinokibi
ArcabitTrojan.Ransom.Sodinokibi.349
AvastWin32:CVE-2018-8453-C [Expl]
BitDefenderGen:Variant.Ransom.Sodinokibi.349
BitDefenderThetaGen:NN.ZexaF.36804.kuX@aSmrSfb
BkavW32.AIDetectMalware
CAT-QuickHealRansom.Revil.S28288304
Cylanceunsafe
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
ElasticWindows.Ransomware.Sodinokibi
EmsisoftGen:Variant.Ransom.Sodinokibi.349 (B)
FortinetW32/Sodinokibi.D!tr.ransom
GDataGen:Variant.Ransom.Sodinokibi.349
GoogleDetected
GridinsoftRansom.Win32.Generic.oa!s1
KasperskyTrojan-Ransom.Win32.Sodin.aar
Kingsoftmalware.kb.a.1000
MAXmalware (ai score=100)
MalwarebytesCrypt.Trojan.Malicious.DDS
MaxSecureTrojan.Malware.73859634.susgen
MicroWorld-eScanGen:Variant.Ransom.Sodinokibi.349
MicrosoftRansom:Win32/Revil.A
RisingRansom.Sodin!8.10CD8 (TFE:2:tgu5Cp8rQfB)
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.DocumentCrypt.cc
SophosTroj/Sodino-BU
SymantecRansom.Sodinokibi
TencentTrojan-Ransom.Win32.Sodinokibi.gen
VBA32TrojanRansom.Sodin
VIPREGen:Variant.Ransom.Sodinokibi.349
VaristW32/Kryptik.AKW.gen!Eldorado
XcitiumMalware@#3u2t5ghnmshh0
ZoneAlarmTrojan-Ransom.Win32.Sodin.aar
alibabacloudRansomware:Win/Sodinokibi.B
tehtrisGeneric.Malware

Network contacts

198.54.116.129 162.243.165.239 192.0.78.13 151.101.2.159 79.137.75.185 132.148.36.74 157.7.156.136 164.132.235.17 212.83.139.44 104.27.188.62 154.0.171.107 5.175.14.11 104.31.64.194 69.168.78.79 185.231.124.135 23.111.74.63 188.165.53.185 197.221.12.212 104.27.137.119 98.129.229.254 5.231.89.54 35.208.108.198 54.36.91.62 198.27.86.111 150.95.52.87 198.71.233.184 134.119.241.127 178.254.32.102 134.0.10.17 37.17.224.9 95.216.101.82 64.150.182.105

DNS requests

1kbk.com.ua 35-40konkatsu.net 365questions.org 8449nohate.org aakritpatel.com abogados-en-alicante.es acomprarseguidores.com aminaboutique247.com apprendrelaudit.com aselbermachen.com associationanalytics.com augenta.com autofolierung-lu.de balticdermatology.lt bbsmobler.se beaconhealthsystem.org besttechie.com boisehosting.net boompinoy.com boulderwelt-muenchen-west.de camsadviser.com ccpbroadband.com celularity.com centuryrs.com coastalbridgeadvisors.com conexa4papers.trade corendonhotels.com deschl.net devstyle.org div-vertriebsforschung.de dutchbrewingcoffee.com filmvideoweb.com

Process list

NameCommand line
296a7521448fb5ab221c211b84a9eb68.exe
powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==