Overview

overview

10

Static

static

10

ad6b1c258c...fb.dll

windows7_x64

10

ad6b1c258c...fb.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad6b1c258c45d7661ef929a5250a69f1a1c7898e90d782772671f3398cb875fb

  • Size

    339KB

  • Sample

    220124-bpyrvshdh6

  • MD5

    7d4c2211f3279201599f9138d6b61162

  • SHA1

    ee410f1d10edc70f8de3b27907fc10fa341f620a

  • SHA256

    ad6b1c258c45d7661ef929a5250a69f1a1c7898e90d782772671f3398cb875fb

  • SHA512

    0057744e1a643152d67f41197d431571bbcd93968727c494c97d7aada6f5824ca668cb3341530ce85d0cb23e0aa1f9dbcc18e162307a6c68ee0df09b3725e3ba

Score
10/10
sodinokibi107ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

10

Campaign

7

C2

lyricalduniya.com

theboardroomafrica.com

chris-anne.com

ownidentity.com

web865.com

paradigmlandscape.com

envomask.com

scentedlair.com

jlgraphisme.fr

andrealuchesi.it

mursall.de

letterscan.de

metcalfe.ca

dentourage.com

chomiksy.net

yayasanprimaunggul.org

opticahubertruiz.com

affligemsehondenschool.be

zealcon.ae

craftingalegacy.com
Attributes
  • net

    true

  • pid

    10

  • prc

    mysql.exe

  • ransom_oneliner

    Your files are encrypted! Open {EXT}.info.txt!

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    7

Targets

    • Target

      ad6b1c258c45d7661ef929a5250a69f1a1c7898e90d782772671f3398cb875fb

    • Size

      339KB

    • MD5

      7d4c2211f3279201599f9138d6b61162

    • SHA1

      ee410f1d10edc70f8de3b27907fc10fa341f620a

    • SHA256

      ad6b1c258c45d7661ef929a5250a69f1a1c7898e90d782772671f3398cb875fb

    • SHA512

      0057744e1a643152d67f41197d431571bbcd93968727c494c97d7aada6f5824ca668cb3341530ce85d0cb23e0aa1f9dbcc18e162307a6c68ee0df09b3725e3ba

    Score
    10/10
    sodinokibi107ransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks