Overview

overview

10

Static

static

10

2026-08-23...il.exe

windows10-2004-x64

10

2026-08-23...il.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-08-23_c0dd00b55874f46896ac2115899c2799_coinminer_elex_revil
  • Size 157KB
  • Sample260823-2e441abk8t
  • SHA256 37ded7ddb885c9feb3ae82fdd35925f51b5bd57455c76732b8d65bed1699e32c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
sodinokibi107discoveryexecutionransomwarespywarestealer

Malware Config

Extracted

Family

  • sodinokibi

Botnet

  • 10

Campaign

  • 7

Decoy

  • awaisghauri.com

  • www.arthakapitalforvaltning.dk

  • achetrabalhos.com

  • www.veggienessa.com

  • harleystreetspineclinic.com

  • phukienbepthanhdat.com

  • renehartman.nl

  • www.radishallgood.com

  • www.glende-pflanzenparadies.de

  • pureelements.nl

  • cormanmarketing.com

  • citydogslife.com

  • www.chatberlin.de

  • donau-guides.eu

  • stringnosis.academy

  • www.breakluckrecords.com

  • rarefoods.ro

  • yourhappyevents.fr

  • jandhpest.com

  • imagine-entertainment.com

Attributes
  • net

    true

  • pid

    10

  • prc

    mysql.exe

  • ransom_oneliner

    Your files are encrypted! Open {EXT}.info.txt!

  • ransom_template

    Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got {EXT} extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/{UID} Page will ask you for the key, here it is: {KEY}

  • sub

    7

Extracted

Path

  • C:\Users\Default\e29fo1h17.info.txt

  • sodinokibi

Ransom Note
  • Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got e29fo1h17 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EAD85833C968A1EF Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/EAD85833C968A1EF Page will ask you for the key, here it is: huXYLyhrt3Qw5j82W4JI7e0U8har9qbPP2TzOKqfOgcFc2k7vomNbjSOKbBDPoVj Dt05GE4/oiyovls9/txVRm8l5qytREyGpVut2S6M3USziZioMlWozT6s3jl7lFyi Pn4ig5NEoOLT2Q7Ma1HJLdT8qgkUMNDPzB2DlBGVLKMpzd+nc0ZZnxO1HwpNBROg n56EFJi4Bj/nhDTa8RVtOH3pN2fhCc8K5B7o4vlyRrGcj/gSSsdtsL7/rXc7QqIZ g6UrJBN5jIsprR+K+EIwXgEtipSYXecBjFdcfWeXndRQXxGTZezufAHexI6ksxQs K51dQJk5lg42IyuNpvNG1eFsoqqJf62Mnfdxwq+tsVLksM4+PLT0HJfNJDL8FETz xjAv1MwckgEL2vAvq4YzKLWARV13Q2W8EVJEmnrPfWUGDHiRPFyLyXLcD7gLF63V 8s4Qr3RuqU6IjfJ7Q2I5CfAHSPkRK2QckxsPqS1QVBcsi75jW6qNYL8VeG4YJfrS tsdkqRzUMA+v1oHELnN4lgZUUyv9mCmHPt9mSnyJ2Sf2VWRZ201NMB113lmGMrc5 yBxl9RYBm0XNL4nH4j9XlAHDhnh7CyQwYpkPZ072+PX4DynC8SkEFHxbhWvHLyMp oMVHLrWheBpIUrggVm6cDRxcubbVRu30lpHcq9dns+PU3UBu7D746S6qS0ob929B BHqbz/eGuMx0EXx4b1jM+KnI9n4IJ92A+p5UvT3SrrIOYXlvX16nRWdlr1EyP0P7 pVGRYgPJLomfwwP6HQlTt8AVLuSHZtFVAQdvd/E3rDXSZJi47lVoG0Db0Q6FU4BZ OsAEdjoO4FxjomrnK+JgJhgRN5w8RX+TForbgGj8/glm3npf09MQLqx3vUuHdFC0 Wmz6jD+BZYLCgCRNeVuThAjRQMzlCBKbVGVeLeJXo61mRvEg7bkt/22CXrNjuf44 qYwzqj4OwCNkH3m4DQvsimglTiEZonFvjJQL4uFF485Khc+f+RsPEc9zfY0vp3yo FO8lxOflCbVUK3Dd/yzYvTrhKYYtPzkt/Zycy+fbIPgHvnle9vw7w1IYLnf8K3WW U82+EOPDEIWR/JkxER7w8E4P8ByYpukLY68sMvxwXIEEKjLrUN6wjYN0JG77qswO HGhYQEnsZBuOXueaXJeXAqsWX7CaALp6uL2yh2AO
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EAD85833C968A1EF

  • http://decryptor.top/EAD85833C968A1EF

Extracted

Path

  • C:\Users\Default\381bzrk.info.txt

  • sodinokibi

Ransom Note
  • Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 381bzrk extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B95D7B129B94045F Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/B95D7B129B94045F Page will ask you for the key, here it is: 42mP4W2XHteHB05mmKQOzfLeoc8LZiO7KHZvm9RNry1MPzmnKS0/nSSWdewWLHVn C62XZiq0zeq47oM5sSz6Sz/sTnxI5pVjFAnKfc1caUAmF/3CHPwbbplMiDHBelGM JGx8pt/pc+iUTcQCBmnyrGl08rAaG8roVACR8fBEJjWwjZIZGoaB674ibPQm47Ga qkgetwd6SapYbnpE50T3dVeeZgvgC2S1ZHesHcYVq7D1cKoYACIC2mEnhdrSb48z KXW/hUfb/zVJtF8dl8whmgAUTfRj7v5xN9KqRrvrJhh/Mvh08KTjfN5wKlXMqpj2 UGai0Ae8MyMFIgJ0agHgiH529c37N3dmDcJ4p8iv2GVlWjr0bJt+IPI3MQWrIPMO K+FiVLpdB2/hST9A+IJ4YpvCPggtGd56UazaG0EHqt4wJa/PP5PE2c66Mj0rnQmN VJGQcMRfe27GwaHZbQ5NLUAC1+rlXQXm5uHyl4eMmc+BM27RyHnAnOp75UQFuM1V UnbxeIfPIBr6bnle9WNoIurOToEnQnbHR7dgPv4+AVTooRvfTRUWsDIkTMYc7FwP PgvrtuwWA1VetGJs09Ucfy8auBMNAobQAG6tVhmMYjwUfLWxlUIqUT80pFWFa3n7 xjyNaNygXdqnWlt29CgeX9r9EMJ8c7hbkCTiqnTDYNgNgJ+QqAW16HeXBgu1kK9f ee8S5PIb79PgZghUW6ZDuBTQ0XgVFG4JXHi0U4yBH2G3d3sC1xjTMcZ6qrz/JSIO ZnOc0I9y5moKVysAccUR+MJHO17Dvq/SvIlG81fIHYll39hSeaPZIxpUB7XgmB+R bT13kUGfANQFHhtJLQS7MGJeQZ8WPwj2WJMJyMxDZLNVG40UagAoWptRbvZXKR7L QXtLheqSUXF5zYVPVpWNq7GkPGpPYeLQqT8Qw+ttXSz/IlgWbpxBZoNHJXM6wS8b tQFvKQYGrO3AOdxOkdG4w4L85dbxIZqppxJJYRWiwooj/zmSp8ltevxQcuaSRh/5 EAfsOFBW4LkfJFmVWhzZUDHBdOQJb+RkOde8C4nZ5QmjngR1VovON26ql5MIwJim 6uw9VlZATlmqiKPKSt1u65DrlJ1uDCnPeiR6UUyTKG0GJtDETQFkI4JNZzj6NxEq DNi0FBy1RUpkNeiSm7wvknSV3a3BXeSOpFoeoTo6cnlggPcqZ13VhIP8MAIw8n8m t+g=
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B95D7B129B94045F

  • http://decryptor.top/B95D7B129B94045F

Targets

    • Target
      2026-08-23_c0dd00b55874f46896ac2115899c2799_coinminer_elex_revil
    • Size 157KB
    • SHA256 37ded7ddb885c9feb3ae82fdd35925f51b5bd57455c76732b8d65bed1699e32c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionsodinokibiransomwarespywarestealer

    • Family: Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Renames multiple (163) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks