Overview

overview

10

Static

static

10

v2.exe

windows10-2004-x64

10

v2.exe

windows11-21h2-x64

10

Resubmissions

23/09/2026, 16:58

260923-vg6bhsfg5310

06/09/2026, 16:14

260906-tp1kkawtev10

05/09/2026, 18:17

260905-ww6fhagk9y10

05/09/2026, 18:17

260905-ww55qsgk9w

14/08/2026, 18:05

260814-wn795abb2310

25/05/2026, 01:59

260525-ceefxaat4n10

01/05/2026, 12:22

260501-pj17pabt5j10

21/04/2026, 16:21

260421-ttqadsht2l10

21/04/2026, 16:07

260421-tk2xtscx7110

19/04/2026, 20:34

260419-zcnccsey4s10

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    21/04/2026, 16:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    v2.exe
  • Size 121KB
  • Sample260421-tk2xtscx71
  • SHA256 74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdiscoverysodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Recovery\a43w5k-readme.txt

  • sodinokibi

Ransom Note
  • ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension a43w5k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/861AB9050ECB90A1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/861AB9050ECB90A1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3RIFkV/BzANvow0Y7gWMld6+hZA4pe9br6VjrBvpF7J25c1JRkRll7UTBh05V6xV i64V8n0urHg1GkSIyGoIlrSRu5hdpqFxDIQHn6BmPeSmhuERLJxLPxECuVs5OxEt +0+sxod4a5cqhC6BlXeE4avusxHEUGSEpEiyRaZ4dW3sGfWBZGPV+28BZF9B9UHd Cdx1OCuhX3+2x+mGfwI7aPiTrGnRuTxnTPb5Pz4fmhR88bV3bGhiwH3ivjqvNB9v L7IBpnDRGJTNTrqBxaGK17VvjuiS0VgsdmdRV5qPvRe35TvcvuBwg8Gvy/TxajKP GnCHSSRtY2wkAE3V4o6JAMqCoh8Br8f4NoGoebAkH/BJZCDG+LYiTAIrB+gRjbya h/jniIENmPlRYu5hUBYFSBBDoRJgpr5BkorZ2SJNkFXGfIOUuh+qVdhBP9Zp0Jen WjXC2M1VZw7IJaD6ta6b1N6udfSGSlxX3MToJXbcGGKNyt9MUueDG7e1DmwL++h7 lWPESt06IHxAI9UitX3rWFFi70yOq3HccV7bDzB4y1TgcRvskZyLHH5saXdqU336 RGPMRmpxVKIdAsYaVc7y/xA3JZPASCgTCIF7Us/OJGA3rGjXyntU6EiihSYWcTTM Xi9iWB4CMlrGMvYFYOUFNh4eTeevUaEI7YTkQxs/kFiHz2lUn96s+5QDQlggUCtH NQFYGXGatx7qxY4t4A33aoSvTgkaeGRDvNlXfF8A9P88wvjkZM9Nh9BQ4An0Dpc6 JU6p2XAQxhl2H9hKS40v6G97iDyDO1wl9+SVZvxssv7NEV1AGibHXe+9wg13/qFc hsgof3IkYE78sRXBATX02O9UM9cbHAStfZ9oZXeFZqn67ZGhVGolmti5iBdl2oYl MxGGm7x9vUrh9whXZASOj7X6ShSL6f2YIz5bp/7QbDWaPsBzTK5gb8Af8Wpa+8yT HIC7uxqZMLdDea3xIxjh7ei+bBiDAcmxN32gjFaaJC6HYWVZ0tniuav2Pj4YKDvB X/+hRS6oUifkSgiI4+okWrl7afM6QXppuEq1s7CK2IDZboK97MgoaiEEi6DqHjbQ 4fv8FL1dY+TlhngW+PsNhjxjqFVEC3bYfR6agYWMhMZaD+bHewil2APdfnhbsCNs DE2r8dQHfXLd60IfzQeMWfx4Z3Eron3ohQXP4kjkIAr5DXhTuEqRSUogdrEFUQ2o +9SrqmWwLEdiPZ7+QCMqaYr3X9RlwV6CDKtzdl3aNcjNWLDpSbEqokWXQOhYwnd4 2Fxryc+/NEwW9ugOouMiDDAuCLyibMCHZyVG+tSe1K8knJHPQfAXGjjYtxoCYMRn orHykP3KxHHA9YnLu06tFzZZlQMRcj1maMv5Kg== ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/861AB9050ECB90A1

  • http://decoder.re/861AB9050ECB90A1

Signatures

  • Family: Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 12 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\v2.exe
    "C:\Users\Admin\AppData\Local\Temp\v2.exe"
    1⤵
    • Drops startup file
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1908
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4984
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3260

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          a43w5k-readme.txt
          • Path C:\Recovery\a43w5k-readme.txt
          • Size 7KB
          • SHA256 2c822f7ef0a11a41fc1492699591988b089e4fda3fa5c3f22dd39aeb4d019184
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download