General
-
Target
6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970.bin
-
Size
244KB
-
Sample
200718-7f8n9pq52a
-
MD5
f82f4f596705763a3c0124a4675d484e
-
SHA1
df1e8b4522bc439d338848f9a4d09d5b1c26f5da
-
SHA256
6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970
-
SHA512
6a0183c211b53cbaf470bd1ab26c347222850dde0fd529aec544ecdf6ab881f06ea7e3a7432497083ac515fec6c07ffcad89ad79f8687fc44dc60b54e3475dfd
Static task
static1
Behavioral task
behavioral1
Sample
6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970.bin.exe
Resource
win10
Malware Config
Extracted
C:\ha7zj-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9E1CBC3DBF05C027
http://decryptor.cc/9E1CBC3DBF05C027
Extracted
C:\w5vhls-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2D93158E4D06F3D1
http://decryptor.cc/2D93158E4D06F3D1
Targets
-
-
Target
6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970.bin
-
Size
244KB
-
MD5
f82f4f596705763a3c0124a4675d484e
-
SHA1
df1e8b4522bc439d338848f9a4d09d5b1c26f5da
-
SHA256
6f2432e4ac98575aa653094123b478bf6c3aa9b00aaad84dfd09045a96d6b970
-
SHA512
6a0183c211b53cbaf470bd1ab26c347222850dde0fd529aec544ecdf6ab881f06ea7e3a7432497083ac515fec6c07ffcad89ad79f8687fc44dc60b54e3475dfd
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives
-
Modifies service
-
Sets desktop wallpaper using registry
-