Static task
static1
Behavioral task
behavioral1
Sample
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe
Resource
win10-en-20211208
General
-
Target
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45
-
Size
1MB
-
MD5
bed6fc04aeb785815744706239a1f243
-
SHA1
3d0649b5f76dbbff9f86b926afbd18ae028946bf
-
SHA256
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45
-
SHA512
1ed873577545dc52ffe3516b10848a0474c7f30dbaeed95c67b9b5a690acf4045c05114231dc4350e60219dea00a7e2be4cedc81a9e8655de59831ac09f53100
-
SSDEEP
1536:Dk+Ih4gfvovCz9XwjeGjplqghkk7Pbi4eTMlux4ICS4A5H:a4gcAwCG1XLbi4eTMlm
Malware Config
Extracted
sodinokibi
1
4
domain3.com
domain2.com
domain1.com
-
net
false
-
pid
1
-
prc
mysql.exe
-
ransom_oneliner
Image text
-
ransom_template
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://z2lnrdtp2u4tl7agvqfgnxr7jxu36egfhft3w6zklaq2fl5be7yt4gad.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://domain2.com/{UID} Page will ask you for the key, here it is: {KEY}
-
sub
4
Signatures
-
Sodinokibi family
-
Sodinokibi/Revil sample 1 IoCs
Processes:
resource yara_rule sample family_sodinokobi
Files
-
3641b09bf6eae22579d4fd5aae420476a134f5948966944189a70afd8032cb45.exe windows x86
5127c8ff00914b312f0361bc6155bca2
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
ExitProcess
GetCurrentThread
GetProcAddress
SetThreadAffinityMask
lstrlenW
LoadLibraryA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleW
IsProcessorFeaturePresent
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.urlgi Size: 1024KB - Virtual size: 1024KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ