Overview

overview

10

Static

static

10

fac5d96467...4e.exe

windows7_x64

10

fac5d96467...4e.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fac5d96467b6b9725b412d3b78eb52e3fa71be748579896774df3f86be1fba4e

  • Size

    158KB

  • Sample

    220124-a1k5gaghc6

  • MD5

    4c41f129572df46a10434ec037a4c092

  • SHA1

    657401643a0c6adfbbdbd76ecac54f889e3d7509

  • SHA256

    fac5d96467b6b9725b412d3b78eb52e3fa71be748579896774df3f86be1fba4e

  • SHA512

    18765a05703a0e2399697d52b1a43048199c624a1bc07d07e043030a252e69e8c4956f0abf452179bec716605cfacfc4bbddb0f1df8df3db488e3be351805965

Score
10/10
sodinokibi1711ransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

17

Campaign

11

C2

poems-for-the-soul.ch

eventosvirtualesexitosos.com

zorgboerderijravensbosch.nl

annida.it

malevannye.ru

zdrowieszczecin.pl

eshop.design

johnkoen.com

brisbaneosteopathic.com.au

cymru.futbol

welovecustomers.fr

martinipstudios.com

galatee-couture.com

parseport.com

michal-s.co.il

devplus.be

customroasts.com

leatherjees.com

afbudsrejserallinclusive.dk

nepressurecleaning.com
Attributes
  • net

    false

  • pid

    17

  • prc

    mysql.exe

  • ransom_oneliner

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. For futher steps {EXT}-readme.txt that is located in every encrypted folder

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    11

Targets

    • Target

      fac5d96467b6b9725b412d3b78eb52e3fa71be748579896774df3f86be1fba4e

    • Size

      158KB

    • MD5

      4c41f129572df46a10434ec037a4c092

    • SHA1

      657401643a0c6adfbbdbd76ecac54f889e3d7509

    • SHA256

      fac5d96467b6b9725b412d3b78eb52e3fa71be748579896774df3f86be1fba4e

    • SHA512

      18765a05703a0e2399697d52b1a43048199c624a1bc07d07e043030a252e69e8c4956f0abf452179bec716605cfacfc4bbddb0f1df8df3db488e3be351805965

    Score
    10/10
    sodinokibiransomwarespywarestealer

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks