SUSPICIOUS — 6167be94c33b2a86f9820cbc1b901700cf5d690193213cb14f44687dd4ed4e18.exe
SUSPICIOUS — 6167be94c33b2a86f9820cbc1b901700cf5d690193213cb14f44687dd4ed4e18.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (64/100), attributed to the REvil family. 5 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
6167be94c33b2a86f9820cbc1b901700cf5d690193213cb14f44687dd4ed4e18 - SHA-1:
4eb4232bee4b5502a1ded712ef3d45b5e553d240 - MD5:
7fdad15d38c44af4039bd440ec83b6e0 - imphash:
160fbdb81ce4965fa57cff73b4673255 - ssdeep:
49152:Mu/ggdwof3JeNoooGcnPsrrdbWTsTBwr2yDgGuWFYVQYOOFekUHdw6trL7bS9gC:+gdwofZedwsTB6+3W89gCJ+imlfmH+ - TLSH:
T12B63389610133082D8B1AE04B421C9DC8053F951AA70D7CE974FE628E3FD6F7DAE58A5 - Submitted as: 6167be94c33b2a86f9820cbc1b901700cf5d690193213cb14f44687dd4ed4e18.exe
- File type: pe · Size: 4915200 bytes
- Verdict: suspicious (64/100) · Family: REvil
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (5 of 52 engines)
- YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): Trojan.GenericKD.81008274
- Kaspersky (KVRT): Trojan.Win32.Vimditator.ngcs
MITRE ATT&CK
Why this verdict
The suspicious score of 64/100 is the fusion of 4 weighted signals:
- YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule
ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - query domain / anti-analysis (rule
query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: https://api.ipify.orghttps://icanhazip.com, http://ip-api.com/json/?fields=country, https://docs.rs/getrandom#nodejs-es-module-supportinternal_codedescriptionunknown_codeos_errorUnknown - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://api.ipify.orghttps://icanhazip.com
- http://ip-api.com/json/?fields=country
- https://github.com/swsnr/gethostname.rs/issues
- https://docs.rs/getrandom#nodejs-es-module-supportinternal_codedescriptionunknown_codeos_errorUnknown
- https://docs.rs/rustls/latest/rustls/manual/_03_howto/index.html#unexpected-eof@
Embedded domains
- openssl.org
- index.crates.io
- icanhazip.com
- ip-api.com
- github.com
- api.ipify.orghttps
- docs.rs
Embedded IP addresses
- 212.80.7.118
- 20.19.18.17
- 16.15.14.13
File paths
- C:\ProgrH
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.4\src\combinators\collect.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.24.0\src\handshake.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.150\src\de.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.24.0\src\buffer.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.24.0\src\protocol\frame\mod.rsP
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.24.0\src\lib.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.4\src\util.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.150\src\value\de.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.24.0\src\tls.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.24.0\src\connect.rs
- C:\Users\benva\.rustup\toolchains\stable-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\collections\btree\map\entry.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.52.3\src\lib.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\response.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\lib.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\atomic-waker-1.1.2\src\lib.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode_suffix.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\mod.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.12.1\src\lib.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.20\src\atomic.rs8i2@
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.20\src\sync\list.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crossbeam-epoch-0.9.20\src\sync\once_lock.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\data-encoding-2.11.0\src\lib.rs
- C:\Users\benva\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-core-0.3.32\src\task\__internal\atomic_waker.rs
More REvil samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report