Overview

overview

10

Static

static

1

4447dee442...b7.exe

windows7_x64

10

4447dee442...b7.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4447dee4424f298d64e15a4ba543090afe27afc9b839cb186ce4ddad3ca6e6b7.exe

  • Size

    373KB

  • Sample

    200323-w53ka8gjds

  • MD5

    3efdc5484d5d58b90bdbc48ba7598446

  • SHA1

    24e23dd6e76f1aa0bd66c92ce2ecfa8c47b831ca

  • SHA256

    4447dee4424f298d64e15a4ba543090afe27afc9b839cb186ce4ddad3ca6e6b7

  • SHA512

    c84ceb205550e473251583aaf7364677a7955daba96183289e4d68a42ad7b41ac176dbb7be37361ec0a0958bd6b5d89dbd726de4b4c23dd4f16ffbb197554fb3

Score
10/10
sodinokibievasionpersistenceransomwarespywaretrojan

Malware Config

Extracted

Path

C:\Recovery\d04s2-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got d04s2 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7F5B51BF3C616D3D Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/7F5B51BF3C616D3D Page will ask you for the key, here it is: Dqz/GoEIPeymszwi0beMw18Pv4kJc5B00jbrDnzBooOsn6DGj4GpplB0dC0Xmxdu XGYARnhPxo4/Naibn814dPJmoHU2uAL84jXHpWzuxK4k94RCGDU8158XuesvOfVD OCyxBjZbfajXHi6pARxqOz9MXMyn8DJ5d5RWkaXnVzoMDkm7c51qgIy0iXIWHSOG w0Lr8QQ9mF96Sq54KmxPFLyz5PLrnVqPO0qUh8iFIHpnAItO/CYUXA6lqPXGExEC xAIyr7Q03+MlhKCUw1ClPR+W3LGa+RH68dUpABHDEnPT3c/AsisCosc6xWA6xyHs C8vEBUlf/Jx+t1IpJWPKM0CeKt6DCf/k8Lp/vqiNJB+8K1iV+bv5VHTry6MCQAyq s7Io/c9BZKEb1K6iQRzdw8Ju/32FiYDMZdLKHffDzPGXKRUpXLM4qTBSmdZZnSB/ fZHvgMV+O/5xtGQqXU3QJ0+SOWzwIawRbp0n8+RS1k5x20yrXEMTdJ+gtswTx3L6 JV4qQrPX3zyljJpr25Lv+G42WZ5rYKiTmNttEBGtPR/vmzgAAwXMx5IEoaCDca60 /RnhwbI0XwPAvhY80W/Nrnr9PIQHSRHC8bVYARahPMUk5jrxjMun2LaK8UqAiVz7 u3oOjn4t11lSXNMrMhgRJOk4b+7nIWARzokDtaGYPU0/8lVBS80muT4zkLVOfUkR AvWSQ3MlB3E2w4UkiEFA0gCR60x+/qY7g51dzmOEH+HbVZgTwror47rQZXOUAygA UMLjfZPJNwvCsXN5x0ZPbfhziY3OwZFCsluP/82yD4WBA++Z8QuUpsiTKWj2xET3 g52B4gPiw5w2OOn6/KXcB9pTtvjRoT5KcIZERYYL4y4uzHbJJaNo9M0JQsiD4+iV nXgJksavHxWHTtPynu6wr5crcNZBEF4UTlJpPTQmuwszJtp8BWYLDx/sCfa0zwsd p5U1d3P1YQfyrHcx06MwqsI2z8hTM5bcAsO/OFCtXGk6ATB7d0nQxXtyIpcgBay4 hQF3yR4nEoEZsyUbo0vyqDynFxUoG1o/EiIhodGtC2/I1oko19m9P6Ucs4dpDOnc /cEIYPU5Sa5VfuzJyCnILAV3R8/LysvAxUg=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7F5B51BF3C616D3D

http://decryptor.top/7F5B51BF3C616D3D

Extracted

Family

sodinokibi

C2

texanscan.org

g2mediainc.com

avis.mantova.it

cac2040.com

zumrutkuyutemel.com

livelai.com

floweringsun.org

jandhpest.com

agora-collectivites.com

mikegoodfellow.co.uk

letterscan.de

voice2biz.com

biodentify.ai

csaballoons.com

angeleyezstripclub.com

innovationgames-brabant.nl

oraweb.net

transifer.fr

alattekniksipil.com

ruggestar.ch
Attributes
  • net

    false

  • pid

    17

  • ransom_oneliner

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. For futher steps {EXT}-readme.txt that is located in every encrypted folder

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    11

Extracted

Path

C:\odt\u1dulvu04-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got u1dulvu04 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3451087DB8F22DD Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/F3451087DB8F22DD Page will ask you for the key, here it is: DPji4uuIUH5/wIrdqBNX823O2pv3rUTmhmY2OXq+HJOQqSqSoTUiiEay7rgZXFKp 714cqsTwn/9TbCoEe1PJZotVEQjw8M3c/hxN9W5reQ/vAJI9CqqJgxeQ4zqWG+P9 NPXyPM6875rBNgfBILW7/mVVMC6GHTnSpncAL+5RzL4KHyxBONZY3FHdrX3oaRuq NHl6tDtyYFeVha5GOVRsFs17haeBx+NvPerkSSoy7VhE73mcmHM1uuMA4azhwnj4 F4HefUkK46tWwQJs6odSi6VCzw0hnns1FmMtLBvdlvIO+YqgRwGKpwgMYH8VS5Sx 3pLKt9B/YiOxmT6RVb+Z1W4pr+nof3bSURZgB/P6iE1esx8wPP6t2Z3yoHSjLBxv he2LoRkIKmydsyId+gj6GZ3GkvmBpB8s35u5vAECXay0XhMTD3pbrGCVwfRTfwHS ExZYj4/0/BD6Zl7hLa2xcf6EdCmHeDnsLHNvDtbnvF4l01b2JCIW41MovaR/k8Et CnIKChJzo0ETH46+XB8aK/olZ981HpTdTWTJOxQCBo7pewe3+7gsNAEoLm5LOH9h U4ZzqV+3qffGmTT58QjxbT4Re5PQXcar3FtwMOLiiSSwZjWxxxfR1z4YWCvTIotc /Oiptcay26EWeQPjh9WYQPxN6eQEYE4TF2a24RALab2bOrZsKb7JF8WsI9X8EKQe 1KT3IPWTnO35uRv1fXZXRpdxCGixDB3dGFAEbdPKt5TwnFQUQijFLg8c6qadIggI hJ299Nzbr8MGDi3sPDhQy2HZ40fe0iF0XD2Zmmmue3v7Ft0eo4AkJxFEkO0lWmUL yArR7xinSFf2c7/xcnDBCnW9bv0c1uIHZu1kx3vAlpz0di+XDlZjVa6Qc1oMCpnQ b5bQO7oektIeI8bQA4ZOuTtFi/frqeNyvh/FNbKnm/Avveo86fN+W/INhicefOMv F1+Z+9mVh9NcPqXAvaWEll/aPsjkSJR3B3ExIW1Jc6tzS0R8QVXPnTS2zdoz7A0O HlkGzXcWKzttNVhJBQZAhkdDOBNVxCW2Z2fukFeFjAg3O/3YfwWZPhliHaJJauje J2laTNa5KZbpKQ==
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3451087DB8F22DD

http://decryptor.top/F3451087DB8F22DD

Targets

    • Target

      4447dee4424f298d64e15a4ba543090afe27afc9b839cb186ce4ddad3ca6e6b7.exe

    • Size

      373KB

    • MD5

      3efdc5484d5d58b90bdbc48ba7598446

    • SHA1

      24e23dd6e76f1aa0bd66c92ce2ecfa8c47b831ca

    • SHA256

      4447dee4424f298d64e15a4ba543090afe27afc9b839cb186ce4ddad3ca6e6b7

    • SHA512

      c84ceb205550e473251583aaf7364677a7955daba96183289e4d68a42ad7b41ac176dbb7be37361ec0a0958bd6b5d89dbd726de4b4c23dd4f16ffbb197554fb3

    Score
    10/10
    ransomwareevasionspywaretrojansodinokibipersistence

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Loads dropped DLL

    • Discovering connected drives

    • Modifies system certificate store

      evasionspywaretrojan

    • Modifies service

      persistence

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks