Overview

overview

10

Static

static

10

a2715f4fe9...8a.exe

windows7_x64

10

a2715f4fe9...8a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a2715f4fe971766681c17ccd0e045f87f7b09d4d57adb99601078ea5c8bbf68a

  • Size

    159KB

  • Sample

    220124-btlyvshdhq

  • MD5

    89b21e0bdc3be808c42a82e17372b4c6

  • SHA1

    6a19a7205c51dc59938b0264f173eeb1815ff4e1

  • SHA256

    a2715f4fe971766681c17ccd0e045f87f7b09d4d57adb99601078ea5c8bbf68a

  • SHA512

    22449634409904eda5f312266afb6f3200e35a1177222be0bc505b6bec2accc5ad3cef3ba43b17c2d2947f6b6f694ba7bc0b3fe825488365565b7972465354b4

Score
10/10
sodinokibi1711ransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

17

Campaign

11

C2

poems-for-the-soul.ch

eventosvirtualesexitosos.com

zorgboerderijravensbosch.nl

annida.it

malevannye.ru

zdrowieszczecin.pl

eshop.design

johnkoen.com

brisbaneosteopathic.com.au

cymru.futbol

welovecustomers.fr

martinipstudios.com

galatee-couture.com

parseport.com

michal-s.co.il

devplus.be

customroasts.com

leatherjees.com

afbudsrejserallinclusive.dk

nepressurecleaning.com
Attributes
  • net

    false

  • pid

    17

  • prc

    mysql.exe

  • ransom_oneliner

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. For futher steps {EXT}-readme.txt that is located in every encrypted folder

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    11

Extracted

Path

C:\g1r6cn8-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got g1r6cn8 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5FA34714DF9BD92 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/A5FA34714DF9BD92 Page will ask you for the key, here it is: EACcvSM32CWobXBJp9crymLpiTToZlWtJdH13TTvJ4WYASXVcrypSxUGk0lTCiHh dTabnJpBAiV24LjYsBpA4pZOcWcg6ReD7Wq5L3fhCN1YzI5Lh0QwTAZdYzJ3VkSF Lvd25DAe7sOLu4BmDvI82RoZEQojzwiCDamNBZQ/eMZTOFdkMenMYCxPS8JjN6eQ LfZtb39WboZ5dU7Y+c7vul60WAQjBxp+k28BPMQeAraflkGN2nxkS+uprsRmmfph 7JJSXYG/73c3lBolCgAWuVlO9H7n0RWAbx8o73jFrOiHqLI05zl+L0/epbZCfws3 jL9yntzNvULdoE2Azwh3fletqHaZhgt4dWlG2eft1ZhCeT8W5DV5mTdZ1JhtJmnL f84sd/OrVbxSWRmODnzQD/U0+jp3/h25ZKrqfGSkAptMUrYFOHfvVN2uX99CgajD 5x6z1UoQ2zmOgkejfG68njd5khDeQvL1kJzZXCAeRvituoDpOu/aB7r/i1EbayTZ AVO/jnJMEqQCZZT2EpC7s+GnpA/+oZiDmSrXvsmiI3DDxny3KkXWO+9PlH/g7UEN LBZsadUMU1H/d/mfGX6JoCNTciPDhEJrApGjbxWKzJbXVo98acJWhbjz4GqAa0Zj 8W+t2aLI4octUjubMMCjAstIbAQqmqwnETbIpe3guXfs0dOYp1IVIIBFordNqur4 LDoNkQrre+INZIltw0Ky2F1MJTbY+Vfu0MQh3XznNjgtJHJn3aw85YiQ3r+aAAAD WnaFht285dl1Ky1vlSiUovyrp/jF1doM6eVnCrb9jQg78ZV4EotyyOYEra/seOMP +HlY8RecVqcr8Id8LeruwNLxahBKbAbZQv7iAhZ+vQRnjJ+/MkJGk1JCARbwMHoY cMcSSVsb91cJ13jAsFkw+00E2roMYAUQacLfS0g9RfCTN1KKgkUczh274UJJhMMJ XiCQmmyLG/zzIBIuhS+iX0L7YZssTHL5Lqh8Sp8PxwY4CskXcTa0+SEym/Ai7Ef/ u4Ky9tyrxl2B+giVJx5sGGm5BtkLPCvlKzrwvTTnwVJGh863CQX5WBKhc0iGd8Z6 YwtQAj4R1fSSzCQgvVtuu/cr
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5FA34714DF9BD92

http://decryptor.top/A5FA34714DF9BD92

Targets

    • Target

      a2715f4fe971766681c17ccd0e045f87f7b09d4d57adb99601078ea5c8bbf68a

    • Size

      159KB

    • MD5

      89b21e0bdc3be808c42a82e17372b4c6

    • SHA1

      6a19a7205c51dc59938b0264f173eeb1815ff4e1

    • SHA256

      a2715f4fe971766681c17ccd0e045f87f7b09d4d57adb99601078ea5c8bbf68a

    • SHA512

      22449634409904eda5f312266afb6f3200e35a1177222be0bc505b6bec2accc5ad3cef3ba43b17c2d2947f6b6f694ba7bc0b3fe825488365565b7972465354b4

    Score
    10/10
    sodinokibiransomwarespywarestealer

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks