General
-
Target
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548
-
Size
157KB
-
Sample
191114-lrhkzccm9n
-
MD5
b488bdeeaeda94a273e4746db0082841
-
SHA1
5dac89d5ecc2794b3fc084416a78c965c2be0d2a
-
SHA256
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548
-
SHA512
2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284
Task
task1
Sample
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe
Resource
win7v191014
Task
task2
Sample
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe
Resource
win10v191014
Malware Config
Extracted
C:\Recovery\3bo60i97w8.info.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4AD8367D582FAEE3
http://decryptor.top/4AD8367D582FAEE3
Extracted
C:\odt\629yumz1.info.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBAFD39AEE599D15
http://decryptor.top/BBAFD39AEE599D15
Targets
-
-
Target
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548
-
Size
157KB
-
MD5
b488bdeeaeda94a273e4746db0082841
-
SHA1
5dac89d5ecc2794b3fc084416a78c965c2be0d2a
-
SHA256
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548
-
SHA512
2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284
-
Registry keys used by Sodinokibi family
-
sodinokibi family
-
Deletes shadow copies
-
Discovering connected drives
-
Sets desktop wallpaper using registry
-