Overview

overview

10

Static

static

34dffdb04c...60.exe

windows7_x64

10

34dffdb04c...60.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160

  • Size

    292KB

  • Sample

    220619-yfhqlsacgn

  • MD5

    ccfde149220e87e97198c23fb8115d5a

  • SHA1

    d514d08571ecd8cece8d704adc8d0c4fa87665ca

  • SHA256

    34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160

  • SHA512

    392a14c9a0c3a98c46e15b873919bdae13f5306a937fd8c869b2a2b435d236433a1eb78d6a953a1722d5b43cb69b4028459d6ea2387a904b4c0f2ec5bc36992e

Score
10/10
sodinokibi73ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

7

Campaign

3

C2

sochi-okna23.ru

www.blavait.fr

kamin-somnium.de

geoweb.software

www.drbrianhweeks.com

kombi-dress.com

johnkoen.com

prodentalblue.com

transifer.fr

matteoruzzaofficial.com

jax-interim-and-projectmanagement.com

hawaiisteelbuilding.com

www.kausette.com

www.galaniuklaw.com

www.atma.nl

www.piestar.com

www.kerstliedjeszingen.nl

biodentify.ai

endlessrealms.net

condormobile.fr
Attributes
  • net

    false

  • pid

    7

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    3

Targets

    • Target

      34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160

    • Size

      292KB

    • MD5

      ccfde149220e87e97198c23fb8115d5a

    • SHA1

      d514d08571ecd8cece8d704adc8d0c4fa87665ca

    • SHA256

      34dffdb04ca07b014cdaee857690f86e490050335291ccc84c94994fa91e0160

    • SHA512

      392a14c9a0c3a98c46e15b873919bdae13f5306a937fd8c869b2a2b435d236433a1eb78d6a953a1722d5b43cb69b4028459d6ea2387a904b4c0f2ec5bc36992e

    Score
    10/10
    sodinokibi73ransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks