Managed XDR

c-windows-apppatch-svchost.exe (Sodinokibi) — malware analysis report

File info

Filename
c-windows-apppatch-svchost.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
File size
338.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
d3babccb595eb9a207d741b11f5721de3d72ed0b
SHA256
8dc4384aa658b5210ab200adaf2c672c3e79eae86cda43e3e1a783298e47f1d3
MD5
3dcf30f4a88ad4f04c2672d5dc215b70

Malwares

  • Sodinokibi

Signatures

Defense Evasion

T1027.002 packer_entropy: Probably contains compressed or encrypted data

Other

yara_rules: Static rules
suspicious_process: Spawns a suspicious process
no_graphical_activity: No graphic activity

Related reports