General
-
Target
0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe
-
Size
290KB
-
Sample
191216-8bfljdyw2s
-
MD5
fb68a02333431394a9a0cdbff3717b24
-
SHA1
1399bf98a509adb07663476dee7f9fee571e09f3
-
SHA256
0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d
-
SHA512
e03b076d36374b263dbc63fc93e793210dc5fd809f783cda6524390590ec56b4fb5c0aa80a52650de60c31f2f6d451fee17c72256100ac7f2c15347c05ab6470
Task
task1
Sample
0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe
Resource
win7v191014
Task
task2
Sample
0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe
Resource
win10v191014
Malware Config
Extracted
C:\Recovery\8jwr0e-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FCB7FDC24C90BB8D
http://decryptor.top/FCB7FDC24C90BB8D
Extracted
C:\odt\05z6g30p91-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BCFA73F317FB2A2B
http://decryptor.top/BCFA73F317FB2A2B
Targets
-
-
Target
0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d.exe
-
Size
290KB
-
MD5
fb68a02333431394a9a0cdbff3717b24
-
SHA1
1399bf98a509adb07663476dee7f9fee571e09f3
-
SHA256
0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d
-
SHA512
e03b076d36374b263dbc63fc93e793210dc5fd809f783cda6524390590ec56b4fb5c0aa80a52650de60c31f2f6d451fee17c72256100ac7f2c15347c05ab6470
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality
-
Deletes shadow copies
-
Discovering connected drives
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Sets desktop wallpaper using registry
-