Ransom.Sodinokibi.1 (file analysis)

The Ransom.Sodinokibi.1 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ransom.Sodinokibi.1 virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ransom.Sodinokibi.1?


File Info:
crc32: 6B8106E5
md5: bb2d90742e11af820f0d9f5cd3d1a520
name: upload_file
sha1: 86d80dab5e2118c37b3136776e0c8150af84a879
sha256: 81878c4cd8c79fcc10478f15ea6d00a0d1151a205943eaf47e8c4cd450db0915
sha512: ddc608e586f8dcad63b49ed601c769d527af00a84793c7e4776b578e597e9ba8adad66b7c4d87adedd8a7c8068a673fe97bb72a1451af3d069bfcbe26e210fde
ssdeep: 1536:p5kbYr+uk+UZgn9lpHSzlkOICS4AR3Ah:MbYrMgn9HdL3Ah
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Ransom.Sodinokibi.1 also known as:

MicroWorld-eScan	Gen:Variant.Ransom.Sodinokibi.1
FireEye	Gen:Variant.Ransom.Sodinokibi.1
CAT-QuickHeal	Trojan.Pynamer
McAfee	RDN/Generic.grp
BitDefender	Gen:Variant.Ransom.Sodinokibi.1
K7GW	Trojan ( 005502831 )
K7AntiVirus	Trojan ( 005502831 )
Symantec	Trojan.Gen.MBT
APEX	Malicious
Paloalto	generic.ml
GData	Gen:Variant.Ransom.Sodinokibi.1
Alibaba	Trojan:Win32/GenKryptik.4a5205fa
ViRobot	Trojan.Win32.Z.Sodinokibi.114176
AegisLab	Trojan.Win32.Sodinokibi.4!c
Tencent	Win32.Trojan.Crypt.Pfjh
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Crypt.XPACK.Gen
Zillya	Trojan.GenKryptik.Win32.31084
TrendMicro	TROJ_GEN.R03FC0PFI19
McAfee-GW-Edition	BehavesLike.Win32.Generic.ct
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Ransom.Sodinokibi.1 (B)
Cyren	W32/Trojan.IMUH-4441
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Win32.Fuery
Microsoft	Trojan:Win32/Tiggre!rfn
Arcabit	Trojan.Ransom.Sodinokibi.1
Acronis	suspicious
ALYac	Gen:Variant.Ransom.Sodinokibi.1
MAX	malware (ai score=99)
Ad-Aware	Gen:Variant.Ransom.Sodinokibi.1
Cylance	Unsafe
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/GenKryptik.DJRI
TrendMicro-HouseCall	TROJ_GEN.R03FC0PFI19
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Yandex	Trojan.GenKryptik!
Ikarus	Trojan-Ransom.Sodinokibi
MaxSecure	Trojan.Malware.8328450.susgen
Fortinet	W32/GenKryptik.DJRI!tr
Webroot	W32.Rogue.Gen
AVG	Win32:Trojan-gen
Cybereason	malicious.42e11a
Avast	Win32:Trojan-gen
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.Ransom.8f1

How to remove Ransom.Sodinokibi.1?

Ransom.Sodinokibi.1 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X