General
-
Target
2024-07-05_b302a6056d8a841eba908d6ad1ca9224_revil
-
Size
118KB
-
Sample
240705-bs29fs1fkh
-
MD5
b302a6056d8a841eba908d6ad1ca9224
-
SHA1
004848c35ab4049b28956b0ef26ea1b75feb8618
-
SHA256
4f07bdca105c11debdf2da89f79c02d55c1396ec622a7a164719ad5c54b75bb0
-
SHA512
062cc9f8e18022c801e65b19de9ba8019cde85ca1b2b32818b5c757a5dab518acf9066f65527ba2859562c1f8fb1e1c9b2a105de116bb2461b5d9fe3b8a0d14a
-
SSDEEP
1536:6xryLRras2vlBmcJW6Xi5wBwBpaKj2dICS4ARo3xuDuZU6mKjmY0zLShEIAo:+dBVJW0BwjX/o+iUzKSER7
Behavioral task
behavioral1
Sample
2024-07-05_b302a6056d8a841eba908d6ad1ca9224_revil.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-07-05_b302a6056d8a841eba908d6ad1ca9224_revil.exe
Resource
win10v2004-20240704-en
Malware Config
Extracted
C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\4g8fe53-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8F91EE6ECCFAF1E1
http://decryptor.cc/8F91EE6ECCFAF1E1
Extracted
C:\Users\Admin\wqm3xz0-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1FD6AD6F86992449
http://decryptor.cc/1FD6AD6F86992449
Targets
-
-
Target
2024-07-05_b302a6056d8a841eba908d6ad1ca9224_revil
-
Size
118KB
-
MD5
b302a6056d8a841eba908d6ad1ca9224
-
SHA1
004848c35ab4049b28956b0ef26ea1b75feb8618
-
SHA256
4f07bdca105c11debdf2da89f79c02d55c1396ec622a7a164719ad5c54b75bb0
-
SHA512
062cc9f8e18022c801e65b19de9ba8019cde85ca1b2b32818b5c757a5dab518acf9066f65527ba2859562c1f8fb1e1c9b2a105de116bb2461b5d9fe3b8a0d14a
-
SSDEEP
1536:6xryLRras2vlBmcJW6Xi5wBwBpaKj2dICS4ARo3xuDuZU6mKjmY0zLShEIAo:+dBVJW0BwjX/o+iUzKSER7
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1