General
-
Target
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548
-
Size
157KB
-
Sample
191216-4rcmytrrka
-
MD5
b488bdeeaeda94a273e4746db0082841
-
SHA1
5dac89d5ecc2794b3fc084416a78c965c2be0d2a
-
SHA256
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548
-
SHA512
2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284
Task
task1
Sample
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe
Resource
win7v191014
Task
task2
Sample
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe
Resource
win10v191014
Malware Config
Extracted
C:\Recovery\43s40i71l.info.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B4D1C7A1B00D6DFF
http://decryptor.top/B4D1C7A1B00D6DFF
Extracted
C:\odt\0c82fz.info.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9071BEAE98BFF0B5
http://decryptor.top/9071BEAE98BFF0B5
Targets
-
-
Target
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548
-
Size
157KB
-
MD5
b488bdeeaeda94a273e4746db0082841
-
SHA1
5dac89d5ecc2794b3fc084416a78c965c2be0d2a
-
SHA256
139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548
-
SHA512
2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality
-
Deletes shadow copies
-
Discovering connected drives
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Sets desktop wallpaper using registry
-