Overview

overview

10

Static

static

10

2026-08-23...il.exe

windows10-2004-x64

10

2026-08-23...il.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_c0dd00b55874f46896ac2115899c2799_coinminer_elex_revil.exe
  • Size 157KB
  • Sample260823-2e441abk8t
  • SHA256 37ded7ddb885c9feb3ae82fdd35925f51b5bd57455c76732b8d65bed1699e32c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexecutionsodinokibiransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Default\381bzrk.info.txt

  • sodinokibi

Ransom Note
  • Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 381bzrk extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B95D7B129B94045F Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/B95D7B129B94045F Page will ask you for the key, here it is: 42mP4W2XHteHB05mmKQOzfLeoc8LZiO7KHZvm9RNry1MPzmnKS0/nSSWdewWLHVn C62XZiq0zeq47oM5sSz6Sz/sTnxI5pVjFAnKfc1caUAmF/3CHPwbbplMiDHBelGM JGx8pt/pc+iUTcQCBmnyrGl08rAaG8roVACR8fBEJjWwjZIZGoaB674ibPQm47Ga qkgetwd6SapYbnpE50T3dVeeZgvgC2S1ZHesHcYVq7D1cKoYACIC2mEnhdrSb48z KXW/hUfb/zVJtF8dl8whmgAUTfRj7v5xN9KqRrvrJhh/Mvh08KTjfN5wKlXMqpj2 UGai0Ae8MyMFIgJ0agHgiH529c37N3dmDcJ4p8iv2GVlWjr0bJt+IPI3MQWrIPMO K+FiVLpdB2/hST9A+IJ4YpvCPggtGd56UazaG0EHqt4wJa/PP5PE2c66Mj0rnQmN VJGQcMRfe27GwaHZbQ5NLUAC1+rlXQXm5uHyl4eMmc+BM27RyHnAnOp75UQFuM1V UnbxeIfPIBr6bnle9WNoIurOToEnQnbHR7dgPv4+AVTooRvfTRUWsDIkTMYc7FwP PgvrtuwWA1VetGJs09Ucfy8auBMNAobQAG6tVhmMYjwUfLWxlUIqUT80pFWFa3n7 xjyNaNygXdqnWlt29CgeX9r9EMJ8c7hbkCTiqnTDYNgNgJ+QqAW16HeXBgu1kK9f ee8S5PIb79PgZghUW6ZDuBTQ0XgVFG4JXHi0U4yBH2G3d3sC1xjTMcZ6qrz/JSIO ZnOc0I9y5moKVysAccUR+MJHO17Dvq/SvIlG81fIHYll39hSeaPZIxpUB7XgmB+R bT13kUGfANQFHhtJLQS7MGJeQZ8WPwj2WJMJyMxDZLNVG40UagAoWptRbvZXKR7L QXtLheqSUXF5zYVPVpWNq7GkPGpPYeLQqT8Qw+ttXSz/IlgWbpxBZoNHJXM6wS8b tQFvKQYGrO3AOdxOkdG4w4L85dbxIZqppxJJYRWiwooj/zmSp8ltevxQcuaSRh/5 EAfsOFBW4LkfJFmVWhzZUDHBdOQJb+RkOde8C4nZ5QmjngR1VovON26ql5MIwJim 6uw9VlZATlmqiKPKSt1u65DrlJ1uDCnPeiR6UUyTKG0GJtDETQFkI4JNZzj6NxEq DNi0FBy1RUpkNeiSm7wvknSV3a3BXeSOpFoeoTo6cnlggPcqZ13VhIP8MAIw8n8m t+g=
URLs

  • http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B95D7B129B94045F

  • http://decryptor.top/B95D7B129B94045F

Signatures

  • Family: Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Renames multiple (153) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_c0dd00b55874f46896ac2115899c2799_coinminer_elex_revil.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c0dd00b55874f46896ac2115899c2799_coinminer_elex_revil.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      PID:2548

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        381bzrk.info.txt
        • Path C:\Users\Default\381bzrk.info.txt
        • Size 3KB
        • SHA256 fca77f3f23f0afe95e573f888da5c9b5c5ad4c48849d179696fa26f2c52dfaac
        • MD5 SHA1 SHA512 TLSH
        Submit Download