General
-
Target
e8kSryaf.bat
-
Size
196B
-
Sample
191220-matk4mdz1j
-
MD5
ed5addafaf214c9296d3c3be2138d501
-
SHA1
20294ab7caea8ba78519b41e12359ed906c0c36d
-
SHA256
632b25be71b19500300e6e3e404c0b3c7bc7f8538bc3db94fac827bb91ee848a
-
SHA512
fc6853c3b1437b8461dedabd04d84cdb4069a24f74f3f2914626942c61abe7444371eb64130a4566b8177a0ada4229d03c2717695cc0252cde7620cb20b82ed8
Task
task1
Sample
e8kSryaf.bat
Resource
win7v191014
Task
task2
Sample
e8kSryaf.bat
Resource
win10v191014
Malware Config
Extracted
http://185.103.242.78/pastes/e8kSryaf
Extracted
C:\7khgp2z3-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/041FB4C15C08312C
http://decryptor.top/041FB4C15C08312C
Targets
-
-
Target
e8kSryaf.bat
-
Size
196B
-
MD5
ed5addafaf214c9296d3c3be2138d501
-
SHA1
20294ab7caea8ba78519b41e12359ed906c0c36d
-
SHA256
632b25be71b19500300e6e3e404c0b3c7bc7f8538bc3db94fac827bb91ee848a
-
SHA512
fc6853c3b1437b8461dedabd04d84cdb4069a24f74f3f2914626942c61abe7444371eb64130a4566b8177a0ada4229d03c2717695cc0252cde7620cb20b82ed8
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality
-
Program crash
-
Discovering connected drives
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-