Overview

overview

10

Static

static

10

d4e89180e5...99.exe

windows7_x64

10

d4e89180e5...99.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
  • Size 157KB
  • Sample220124-bbj2jshbc5
  • SHA256 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
  • MD5 SHA1 SHA512
Score
10/10
sodinokibi95ransomware

Malware Config

Extracted

Family

  • sodinokibi

Botnet

  • 9

Campaign

  • 5

C2

  • dnqa.co.uk

  • juergenblaetz.de

  • stabilisateur.fr

  • dentalcircle.com

  • jonnyhooley.com

  • creohn.de

  • www.factorywizuk.com

  • rubyaudiology.com

  • biodentify.ai

  • b3b.ch

  • unislaw-narty.pl

  • patassociation.com

  • aciscomputers.com

  • rename.kz

  • marmarabasin.com

  • christianscholz.de

  • www.mrmac.com

  • annida.it

  • baumfinancialservices.com

  • devplus.be

Attributes
  • net

    true

  • pid

    9

  • prc

    mysql.exe

  • ransom_oneliner

    Your computer have been infected!

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    5

Targets

    • Target
      d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
    • Size 157KB
    • SHA256 d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299
    • MD5 SHA1 SHA512
    Score
    10/10
    sodinokibiransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks