Overview

overview

10

Static

static

8

ed6a1ed68b...le.exe

windows7_x64

10

ed6a1ed68b...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed6a1ed68b174317a010ce5ce54c5e7a865e11ddbf44ab46655dab99cbcb7fce.bin.sample

  • Size

    227KB

  • Sample

    210602-dely41xlv2

  • MD5

    b37073ae26f632e2dacc72c6bdcac77d

  • SHA1

    fc05be408949282741a271ba827037665762187a

  • SHA256

    ed6a1ed68b174317a010ce5ce54c5e7a865e11ddbf44ab46655dab99cbcb7fce

  • SHA512

    c5cc4d8707211893b66a1b4bb9ac609789a87e59a0b7fd429b473245e2e9367a3295a42665959a406ea1ed18d969e432a0c3e0830d8771feec19b038498d1e17

Score
10/10
sodinokibi73ransomwarespywarestealerupx

Malware Config

Extracted

Family

sodinokibi

Botnet

7

Campaign

3

C2

sochi-okna23.ru

www.blavait.fr

kamin-somnium.de

geoweb.software

www.drbrianhweeks.com

kombi-dress.com

johnkoen.com

prodentalblue.com

transifer.fr

matteoruzzaofficial.com

jax-interim-and-projectmanagement.com

hawaiisteelbuilding.com

www.kausette.com

www.galaniuklaw.com

www.atma.nl

www.piestar.com

www.kerstliedjeszingen.nl

biodentify.ai

endlessrealms.net

condormobile.fr
Attributes
  • net

    false

  • pid

    7

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    3

Extracted

Path

C:\odt\74we96t-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 74we96t extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/252E352639CBC4AB Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/252E352639CBC4AB Page will ask you for the key, here it is: YLi4MJC1Tjzzptv0t5NDvtp3h78vYSJZDYnwuEt/Qt3ItNRxucK1nB1PQncMTvCm qsIjDzXVRFLivp+6QX3+qSLzXnNxEJ4Fi5mPTNRUjlc8VpaDQZPX1Day4pOcoICD gbLSEP9n6IUfaByHJaeBHESQVmpVGSanJEfoz3ytxEztGI+Ofc7ozDxCb6tnv4Ri /hvn8vBLV+6tljOoroVLjszmmcsYQMcGQlDq61P+cnRGC54SrOSk432bxqzja4Yu DZvHiwn7m5jmUjIYu5lU5b+MAoGJ9Fukif4LivogxuC+AK4UQrwSIcS218PR7mW/ Pzv4qYCfEPPZGJ2C2vdFwjRH7hRWnW83Pktf7VJuwIb5OHFpWeA1cZN5Vqe+/Fza BYLlTz6Xc3do0RndW89g3BnBcI0TMX/dqyv2ReALSVExJnyPzyUS/5iCgLUhK4GI Ro7pa1eGik8ekLKYTkWSBus/Dwhy/xaV+SBQsPUEqV9CL3bBSImrnM2AFLhDJtEE FeVWjjJYz220tVkgggzWMxx5Gq2tYKMibEOVG/w5SIRRi/GM/oezxjvxT7zn8wTR 5lqSvKoLOEtaDtCeAADBgvSq4ssiKi3EShASeB2bhlTmqorCHhmOA5Mt3qzcBsh3 9XjIXx23ShSX2K9+fafcy22IUg6T54/0o+Z7m2471pZFOWzwZmoG9I/kDhv253on s1wBwdpeGD6wtg5JDR27Plmm6w/Esz5cFaF7TIOtIGzeH7l8NDrEXeQ4zR3SxrMQ RpYOUP9+qZVbfWxV2hrXp8cINXOEBUsfQI2gchFz+XL7+5EZUV9kwU950MwoXLSD EtFD6UCmo4s5/LcHCbleh5iQBx/OyPNO+yN1EJHoQfVGeFiXRI3J9+j+dV+KPJep pvy0BpSOLwSExf672VA0rdv/69P9KpoIfWW0rNrQwdfK4qgQWyvQ2MNnJhE4RV6p UGyYPm06JDwhHtnoSrpfMWHquFLQfIpBIXe61hhVs2nk2W91/E+yVPVqqpPPkD9I zlZ5zhGGq9MnZvcM411SRELKvBl5HxiDxriTtD4tWZQoTRU+TR483Ks6BZm1tBRP bSWre/yk
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/252E352639CBC4AB

http://decryptor.top/252E352639CBC4AB

Targets

    • Target

      ed6a1ed68b174317a010ce5ce54c5e7a865e11ddbf44ab46655dab99cbcb7fce.bin.sample

    • Size

      227KB

    • MD5

      b37073ae26f632e2dacc72c6bdcac77d

    • SHA1

      fc05be408949282741a271ba827037665762187a

    • SHA256

      ed6a1ed68b174317a010ce5ce54c5e7a865e11ddbf44ab46655dab99cbcb7fce

    • SHA512

      c5cc4d8707211893b66a1b4bb9ac609789a87e59a0b7fd429b473245e2e9367a3295a42665959a406ea1ed18d969e432a0c3e0830d8771feec19b038498d1e17

    Score
    10/10
    sodinokibi73ransomwarespywarestealer

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks