Overview

overview

10

Static

static

10

f1bc14943c...3d.dll

windows7_x64

10

f1bc14943c...3d.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1bc14943c240f59b8d3ad4d6e3ad5568f896f80e79697e690612c5602fa653d

  • Size

    339KB

  • Sample

    220124-a3fyjaghbm

  • MD5

    3a0458663d70cbde0099df95da451529

  • SHA1

    cae4d2752133e9351d2ad63fba4699558c7c922a

  • SHA256

    f1bc14943c240f59b8d3ad4d6e3ad5568f896f80e79697e690612c5602fa653d

  • SHA512

    d7fa5a2f15e5820afa9bdeda0af65ee4327df4a36c9fd09f5539686a5a2557e7c6cda20ab4afabfa903733371390afe5ea3f3ea0aa1a332078131299aad9c51b

Score
10/10
sodinokibi107ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

10

Campaign

7

C2

lyricalduniya.com

theboardroomafrica.com

chris-anne.com

ownidentity.com

web865.com

paradigmlandscape.com

envomask.com

scentedlair.com

jlgraphisme.fr

andrealuchesi.it

mursall.de

letterscan.de

metcalfe.ca

dentourage.com

chomiksy.net

yayasanprimaunggul.org

opticahubertruiz.com

affligemsehondenschool.be

zealcon.ae

craftingalegacy.com
Attributes
  • net

    true

  • pid

    10

  • prc

    mysql.exe

  • ransom_oneliner

    Your files are encrypted! Open {EXT}.info.txt!

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    7

Targets

    • Target

      f1bc14943c240f59b8d3ad4d6e3ad5568f896f80e79697e690612c5602fa653d

    • Size

      339KB

    • MD5

      3a0458663d70cbde0099df95da451529

    • SHA1

      cae4d2752133e9351d2ad63fba4699558c7c922a

    • SHA256

      f1bc14943c240f59b8d3ad4d6e3ad5568f896f80e79697e690612c5602fa653d

    • SHA512

      d7fa5a2f15e5820afa9bdeda0af65ee4327df4a36c9fd09f5539686a5a2557e7c6cda20ab4afabfa903733371390afe5ea3f3ea0aa1a332078131299aad9c51b

    Score
    10/10
    sodinokibi107ransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks