General
-
Target
2024-08-31_75782eddce812a43f50647c717392b3b_revil_sodinokibi
-
Size
157KB
-
Sample
240831-vz2q2swdrn
-
MD5
75782eddce812a43f50647c717392b3b
-
SHA1
0913c78ec2b2dbc14d42f91b590f87d58f188c7f
-
SHA256
1639475293a4d7f82bc5e218637ef5fd43d5163657384ec96fe63e78a19a8203
-
SHA512
d85eddbddd0094fcfc251be398f5b20a97056d381f2100fdfa140cab45ba20c63b1abe984f0a4d29eb68a265bc21645a7e9d95189855d4b7dd66f1e19e4c464c
-
SSDEEP
1536:L+bolsa+dSn91zyKRpK63R7Pbi4eTMluxtXDCntTnICS4AhburoHDycTgSAIc026:4do1zyKzVLbi4eTMlwDCnuusjeopL
Behavioral task
behavioral1
Sample
2024-08-31_75782eddce812a43f50647c717392b3b_revil_sodinokibi.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-31_75782eddce812a43f50647c717392b3b_revil_sodinokibi.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Users\Default\8tq15xrc99-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/961EE5448960D5A2
http://decryptor.top/961EE5448960D5A2
Extracted
C:\Users\Default\gqez7x94-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A9732B6313D4685
http://decryptor.top/5A9732B6313D4685
Targets
-
-
Target
2024-08-31_75782eddce812a43f50647c717392b3b_revil_sodinokibi
-
Size
157KB
-
MD5
75782eddce812a43f50647c717392b3b
-
SHA1
0913c78ec2b2dbc14d42f91b590f87d58f188c7f
-
SHA256
1639475293a4d7f82bc5e218637ef5fd43d5163657384ec96fe63e78a19a8203
-
SHA512
d85eddbddd0094fcfc251be398f5b20a97056d381f2100fdfa140cab45ba20c63b1abe984f0a4d29eb68a265bc21645a7e9d95189855d4b7dd66f1e19e4c464c
-
SSDEEP
1536:L+bolsa+dSn91zyKRpK63R7Pbi4eTMluxtXDCntTnICS4AhburoHDycTgSAIc026:4do1zyKzVLbi4eTMlwDCnuusjeopL
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1