General
-
Target
2024-03-29_9ef9a8497761db7ffb2d35c150a376e1_revil
-
Size
118KB
-
Sample
240329-1k2qdsbc45
-
MD5
9ef9a8497761db7ffb2d35c150a376e1
-
SHA1
b1512c25ab74d1b6e968a9ad6deb1ca17e2a7728
-
SHA256
07f13ae44f7dfe796d27023a327d5f3e8c615ba9c897faa35d21c77eedc32f55
-
SHA512
55dfee7dcb56f6cba38a61eeae5dc569b50f6036fac1afb6f81c83051403d1d25a700ec3097da0efd4daa18a934cd74add875e43c22d57ed5e85a65e8ea27a6f
-
SSDEEP
1536:LRp9QsX29hfYI63FRRMjjXpuAin2LDndpeKCoICS4AVEiyVc2owUtQK2QWwn:K+5cjXMWDn/UDELc2ojQP
Behavioral task
behavioral1
Sample
2024-03-29_9ef9a8497761db7ffb2d35c150a376e1_revil.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
2024-03-29_9ef9a8497761db7ffb2d35c150a376e1_revil.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Recovery\dece5d02-e637-11ee-8d99-de339d6e7664\u5tp571-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/61D804EEED47BF9D
http://decryptor.cc/61D804EEED47BF9D
Extracted
C:\Recovery\WindowsRE\3pc92-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AAEC3C51F8184C8D
http://decryptor.cc/AAEC3C51F8184C8D
Targets
-
-
Target
2024-03-29_9ef9a8497761db7ffb2d35c150a376e1_revil
-
Size
118KB
-
MD5
9ef9a8497761db7ffb2d35c150a376e1
-
SHA1
b1512c25ab74d1b6e968a9ad6deb1ca17e2a7728
-
SHA256
07f13ae44f7dfe796d27023a327d5f3e8c615ba9c897faa35d21c77eedc32f55
-
SHA512
55dfee7dcb56f6cba38a61eeae5dc569b50f6036fac1afb6f81c83051403d1d25a700ec3097da0efd4daa18a934cd74add875e43c22d57ed5e85a65e8ea27a6f
-
SSDEEP
1536:LRp9QsX29hfYI63FRRMjjXpuAin2LDndpeKCoICS4AVEiyVc2owUtQK2QWwn:K+5cjXMWDn/UDELc2ojQP
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-