General
-
Target
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe
-
Size
160KB
-
Sample
230807-j9kdzaed44
-
MD5
b572a0486274ee9c0ba816c1b91b87c7
-
SHA1
43a904323a8583203b307c622c71c8ca706c2462
-
SHA256
15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b
-
SHA512
77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171
-
SSDEEP
3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg
Behavioral task
behavioral1
Sample
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
C:\ProgramData\33ygh39u3-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/569FAA6380C8B137
http://decryptor.top/569FAA6380C8B137
Extracted
C:\ProgramData\ta1kr80c2-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6ED632DB0757E0A5
http://decryptor.top/6ED632DB0757E0A5
Targets
-
-
Target
2023-08-06_b572a0486274ee9c0ba816c1b91b87c7_revil_sodinokibi.exe
-
Size
160KB
-
MD5
b572a0486274ee9c0ba816c1b91b87c7
-
SHA1
43a904323a8583203b307c622c71c8ca706c2462
-
SHA256
15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b
-
SHA512
77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171
-
SSDEEP
3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-