Overview

overview

10

Static

static

10

d4e89180e5...99.exe

windows7_x64

10

d4e89180e5...99.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299

  • Size

    157KB

  • Sample

    220124-bbj2jshbc5

  • MD5

    cb10b8ae80227663ab17ab7b206c3057

  • SHA1

    3eb865331bf14ce7c22cd7464928432285820824

  • SHA256

    d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299

  • SHA512

    72c2ebce70ea3b6c76b4ce84171ce28bdd322f9caae94eba7ac491e134fb67c953738dda4a52efe869874b731a28d711887a6957ff24d2376c0c505b300a4b89

Score
10/10
sodinokibi95ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

9

Campaign

5

C2

dnqa.co.uk

juergenblaetz.de

stabilisateur.fr

dentalcircle.com

jonnyhooley.com

creohn.de

www.factorywizuk.com

rubyaudiology.com

biodentify.ai

b3b.ch

unislaw-narty.pl

patassociation.com

aciscomputers.com

rename.kz

marmarabasin.com

christianscholz.de

www.mrmac.com

annida.it

baumfinancialservices.com

devplus.be
Attributes
  • net

    true

  • pid

    9

  • prc

    mysql.exe

  • ransom_oneliner

    Your computer have been infected!

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    5

Targets

    • Target

      d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299

    • Size

      157KB

    • MD5

      cb10b8ae80227663ab17ab7b206c3057

    • SHA1

      3eb865331bf14ce7c22cd7464928432285820824

    • SHA256

      d4e89180e559721e6bcd9c03549d540282c3774bdd6ae61a61d57a23c10fc299

    • SHA512

      72c2ebce70ea3b6c76b4ce84171ce28bdd322f9caae94eba7ac491e134fb67c953738dda4a52efe869874b731a28d711887a6957ff24d2376c0c505b300a4b89

    Score
    10/10
    sodinokibiransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks