General
-
Target
2024-03-07_57bb226213f038b7fd016ab0463632df_revil
-
Size
118KB
-
Sample
240307-a4glfsdd2y
-
MD5
57bb226213f038b7fd016ab0463632df
-
SHA1
a19d79621b327e1a6b6010b73e5f96cbea895d43
-
SHA256
c7f7ed131d7b0759910ec04e5f25f0fa4f23b89f768fca1ffbffcfa130813a93
-
SHA512
cd679c07da96c88a071f5a27825333159b257be5e49ae5852395b225a3bddf81d7d24592c9270e583a0f115f9955d332f97814806fb53573ec869569568afd85
-
SSDEEP
1536:6xryLRras2vlBmcJW6Xi5wBwBpaKj2dICS4ARoGjnmFxVd0dEtr0kJBhnv:+dBVJW0BwjX/o9xVSAIkjhnv
Behavioral task
behavioral1
Sample
2024-03-07_57bb226213f038b7fd016ab0463632df_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-07_57bb226213f038b7fd016ab0463632df_revil.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Recovery\5b7985c2-d100-11ee-bb00-c695cbc44580\wwyhp-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DB30F55E04B68613
http://decryptor.cc/DB30F55E04B68613
Extracted
C:\Recovery\WindowsRE\28rm8aq4-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7BA1E3302E49149D
http://decryptor.cc/7BA1E3302E49149D
Targets
-
-
Target
2024-03-07_57bb226213f038b7fd016ab0463632df_revil
-
Size
118KB
-
MD5
57bb226213f038b7fd016ab0463632df
-
SHA1
a19d79621b327e1a6b6010b73e5f96cbea895d43
-
SHA256
c7f7ed131d7b0759910ec04e5f25f0fa4f23b89f768fca1ffbffcfa130813a93
-
SHA512
cd679c07da96c88a071f5a27825333159b257be5e49ae5852395b225a3bddf81d7d24592c9270e583a0f115f9955d332f97814806fb53573ec869569568afd85
-
SSDEEP
1536:6xryLRras2vlBmcJW6Xi5wBwBpaKj2dICS4ARoGjnmFxVd0dEtr0kJBhnv:+dBVJW0BwjX/o9xVSAIkjhnv
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-