sodinokibi | 6329693e5c61a2f0fa1a53bd177f5a332ef729050b3f109630b759c792f0b986

General

Target

145ba213336bbb05c09d2bcf198aa3bd_JaffaCakes118
Size

416KB
Sample

240504-y9hmpsdd79
MD5

145ba213336bbb05c09d2bcf198aa3bd
SHA1

517dc0d3d853c09fd7cb69aa85fc8f37b9bf3a87
SHA256

6329693e5c61a2f0fa1a53bd177f5a332ef729050b3f109630b759c792f0b986
SHA512

1868d5e625f2fb48f1ca59a34d6b0ebee612d5c657adc349ddc9b5984409e0e9844f5a31f81a1f1e1234e44064f695de07843f1fad3aad54e051e6620127a4b1
SSDEEP

6144:RQNOV3wQRokxB8n7zPUmmTg2OJH80FjTz/XmlH9n7a:qCFRoI8zP38OJ80Fjff49u

Score

10^/10

sodinokibi 17 11 defense_evasion execution impact ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

17

Campaign

11

Decoy

texanscan.org

g2mediainc.com

avis.mantova.it

cac2040.com

zumrutkuyutemel.com

livelai.com

floweringsun.org

jandhpest.com

agora-collectivites.com

mikegoodfellow.co.uk

letterscan.de

voice2biz.com

biodentify.ai

csaballoons.com

angeleyezstripclub.com

innovationgames-brabant.nl

oraweb.net

transifer.fr

alattekniksipil.com

ruggestar.ch

Attributes

net
true
pid
17
prc
mysql.exe
ransom_oneliner
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. For futher steps {EXT}-readme.txt that is located in every encrypted folder
ransom_template
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}
sub
11

Extracted

Path

C:\Users\Default\610e21li1-readme.txt

Family

sodinokibi

Ransom Note

Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 610e21li1 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/58A391D02A3CDDBA Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/58A391D02A3CDDBA Page will ask you for the key, here it is: NtmT7rhyN09AEN4EP+5RjYiEORn/q4IV7rusUSJO1SoZdNfLWaD9Vv33DXEZkWJK RiFvsAmx7pECwdYFY08dJ3N5QJebczAVN2jF5JgljwjBzjgBMgGrrFciIS1MWZi+ EyL4uf5cQd/9P8LHrXt4odqVAaZsOADAjsEkhBv4elrDDpMzJatwYzIjP8z0DO6V s/4ZFUB1o0/BykUtQUTiR2Jsw+1+3ZI35/LslD3C3vzPWk+DHYdX4vc8ZNnoxX1h EjYRN18h1KonPNAzQwvsD27bFRODb20lbTyx6fFGn1b/6lEDyGmB/B2bgcL+i7OL MHyOUJW1JdobBKt7IJgQN/Djygq4dfBwMb9K1WQKIrlChse+J0msd5dr32aPIhy9 A5ph67KPws0Q85h5iiIlEZjHSixFiIp1qqI28uELWWTNytKo/ObfBTgiF0gKBLX2 VedExrEEHe1ZlT8SNZed7rFTHDLGwzh+S0MBthvurXRXsG9NA0tO6Q/VR+bIoLxl Kr1nE4eSyNzvMHsAbC5WTUsfFcXYelJIvcu9c0idHu4SjYCUDFh5ebDJCeWf8MxB MtPExo6as4/ajMewp30A82SBQq6Fo+7sdo1BcM6OE+I9bqiwNCDp79IN/cH/M9RQ oWSwv46ijQB34ffsK+4kirmQL/HRvZu5OJr0xix/+ewIIqt5syq8ccJe4kJhiSMe 0JWdj2Xx4HJiTwf172kOLmCmGSA4C8fuV8CMzmoCQWmEqVacydrOY+kQgUTXJwQG pBjn4TXjikJyFEQ0JL4wJOB+X98NQQccRh4xs8sc5/YYJi8CqvD1tbsvAglQMcSb mVYE5XNtHrD+P+ncVAZ/VuaJz7dKf3rxARkfz02B+o/MywRWpBfrZqVXFa1JxCAY XIsm6baFI/tndBIqXA73EcHlH93qfb4Hzh+Ci8DqFy5cU/IoABD7bx4o5ZtRn183 8Pzr+J4qs3L/84acA9ZBKRaP4wQUT8szlmPkJShAxKv7XVawnzImopM9yYT1BqCg uAy6wRiM0N1UF9gPkHfFmysG+31afIPLzxaRxBelokwSEyDqtJTlVAuIf0xDV458 0eqoBu82fnF9IUfr5JyISpgPPPIa+v+QRFr5uX1FX7zz0u6X/x5BqnVcVeCdgd58 sK9X0ok/yxt5D705ylDcemJROfWt2DMp7ek=

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/58A391D02A3CDDBA

http://decryptor.top/58A391D02A3CDDBA

Targets

- Target
  
  145ba213336bbb05c09d2bcf198aa3bd_JaffaCakes118
- Size
  
  416KB
- MD5
  
  145ba213336bbb05c09d2bcf198aa3bd
- SHA1
  
  517dc0d3d853c09fd7cb69aa85fc8f37b9bf3a87
- SHA256
  
  6329693e5c61a2f0fa1a53bd177f5a332ef729050b3f109630b759c792f0b986
- SHA512
  
  1868d5e625f2fb48f1ca59a34d6b0ebee612d5c657adc349ddc9b5984409e0e9844f5a31f81a1f1e1234e44064f695de07843f1fad3aad54e051e6620127a4b1
- SSDEEP
  
  6144:RQNOV3wQRokxB8n7zPUmmTg2OJH80FjTz/XmlH9n7a:qCFRoI8zP38OJ80Fjff49u
Score

10^/10

sodinokibi 17 11 defense_evasion execution impact ransomware spyware stealer
- Sodin,Sodinokibi,REvil
  Ransomware with advanced anti-analysis and privilege escalation functionality.
  ransomware sodinokibi
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (175) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2