Overview

overview

10

Static

static

ad144912fc...82.exe

windows7-x64

10

ad144912fc...82.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ad144912fc680308d6b8fe71dfff6b5e2779b47ebdc7b60a4a5cfb038e89b382

  • Size

    290KB

  • Sample

    221128-glywcaeg7y

  • MD5

    31bcf5daebd27cf8719e45782dc931b0

  • SHA1

    8007bf6dbeff8bd8a57ea1a52f946b7013407c10

  • SHA256

    ad144912fc680308d6b8fe71dfff6b5e2779b47ebdc7b60a4a5cfb038e89b382

  • SHA512

    47471358bb4f2a6cc566f98ef952faee0bd7e2ec1b197e5e45f5ad0e05c13fb8ebbfbefc32752cc9d9062579ec268ee76156bd58f213135abbb44458ca6494c9

  • SSDEEP

    6144:sGZamLIoveZefyOrA80qE1lHJv3loPxV:sEsomZef5k8k3s

Score
10/10
sodinokibi73ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

7

Campaign

3

Decoy

sochi-okna23.ru

www.blavait.fr

kamin-somnium.de

geoweb.software

www.drbrianhweeks.com

kombi-dress.com

johnkoen.com

prodentalblue.com

transifer.fr

matteoruzzaofficial.com

jax-interim-and-projectmanagement.com

hawaiisteelbuilding.com

www.kausette.com

www.galaniuklaw.com

www.atma.nl

www.piestar.com

www.kerstliedjeszingen.nl

biodentify.ai

endlessrealms.net

condormobile.fr
Attributes
  • net

    false

  • pid

    7

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    3

Targets

    • Target

      ad144912fc680308d6b8fe71dfff6b5e2779b47ebdc7b60a4a5cfb038e89b382

    • Size

      290KB

    • MD5

      31bcf5daebd27cf8719e45782dc931b0

    • SHA1

      8007bf6dbeff8bd8a57ea1a52f946b7013407c10

    • SHA256

      ad144912fc680308d6b8fe71dfff6b5e2779b47ebdc7b60a4a5cfb038e89b382

    • SHA512

      47471358bb4f2a6cc566f98ef952faee0bd7e2ec1b197e5e45f5ad0e05c13fb8ebbfbefc32752cc9d9062579ec268ee76156bd58f213135abbb44458ca6494c9

    • SSDEEP

      6144:sGZamLIoveZefyOrA80qE1lHJv3loPxV:sEsomZef5k8k3s

    Score
    10/10
    sodinokibi73ransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks