General
-
Target
2024-12-26_ea5d24b9bdfb7ea892b4ff16bc2c9d42_revil_sodinokibi
-
Size
561KB
-
Sample
241226-lhp69asmeq
-
MD5
ea5d24b9bdfb7ea892b4ff16bc2c9d42
-
SHA1
40717d8266cf429ddc7df3a29248ef3bc8678a44
-
SHA256
6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a
-
SHA512
fef1c194135b4341da580de14d66d1cfb5b0207f5c57aa8bedb5f2f677c1dc913fb450a89de424d093da8a60c422af4aa4f189a95aa825e6e7c84e28b859f547
-
SSDEEP
12288:PIUykkZ3UdvReTV6dtXyLkzjF+4AYdvReTV6dtXyLkzjF+4AWLkzjF+4Ay:PIUWOZcLkzjF+4XZcLkzjF+4LLkzjF+s
Behavioral task
behavioral1
Sample
2024-12-26_ea5d24b9bdfb7ea892b4ff16bc2c9d42_revil_sodinokibi.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-12-26_ea5d24b9bdfb7ea892b4ff16bc2c9d42_revil_sodinokibi.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
C:\Users\Default\363ki-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1E69207F02171CE2
http://decryptor.top/1E69207F02171CE2
Extracted
C:\Users\Default\0ho590d37-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DB7F3659722B2F3E
http://decryptor.top/DB7F3659722B2F3E
Targets
-
-
Target
2024-12-26_ea5d24b9bdfb7ea892b4ff16bc2c9d42_revil_sodinokibi
-
Size
561KB
-
MD5
ea5d24b9bdfb7ea892b4ff16bc2c9d42
-
SHA1
40717d8266cf429ddc7df3a29248ef3bc8678a44
-
SHA256
6c1245be0cacd3a2c296aeac93bd3a95debfe1497fd23f91d6a2179bf8e1a32a
-
SHA512
fef1c194135b4341da580de14d66d1cfb5b0207f5c57aa8bedb5f2f677c1dc913fb450a89de424d093da8a60c422af4aa4f189a95aa825e6e7c84e28b859f547
-
SSDEEP
12288:PIUykkZ3UdvReTV6dtXyLkzjF+4AYdvReTV6dtXyLkzjF+4AWLkzjF+4Ay:PIUWOZcLkzjF+4XZcLkzjF+4LLkzjF+s
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1