Sodinokibi was first spotted in April 2019, a few months before the GandCrab “retirement”. It was observed to have a variety of initial access:
- Vulnerability (e.g. Oracle WebLogic Server vulnerability CVE-2019-2725)
- Spearphishing with Attachment/Link
- Drive-by Compromise
- RDP / Valid Accounts
Around March 2020, it began the same practice of using stolen files as leverage for ransom payment as well. They published over 12 GB of stolen data allegedly belonging to a company named Brooks International for not paying the ransom during this time.
No observed relations with other malwares unlike other ransomwares, may have a variety of attack flows due to the RaaS nature.
Behaviour
- Deletes Shadow Volume Copy
- Maintains persistence on the targeted machine
- Terminates processes
- Stops services
Capabilities
- File Encryption
- Disabling usage capability
Impact
- Data loss - loss of important files, documents and other data upon encryption
- Financial loss - users are asked to pay in order to decrypt files that were affected
- Information Theft
Infection Routine
Current infection flow based on available data and research regarding other variants/incidents related to Sodinokibi:
- Common Flow:
- More Specific/Targeted Flow:
File Reputation
| Detection/Policy/Rules | Pattern Branch/Version | Release Date / Last update |
|---|---|---|
| Ransom.Win32.SODINOKIBI.THDO | Pattern available in OPR 16.235.00 | September 19, 2020 |
| Ransom.Win32.SODINOKIB.SMTH | Pattern available in OPR 16.319.00 | November 1, 2020 |
| Ransom.Win32.SODINOKIB.SMTH | Pattern available in OPR 16.389.00 | December 3, 2020 |
| TROJ_GEN.R002C0DH520 | Pattern available in OPR 16.379.00 | November 20, 2020 |
| Ransom.Win32.SODINOKIBI.AUWUJDES | Pattern available in OPR 16.910.00 | August 28, 2020 |
Predictive Machine Learning
| Detection | Pattern Branch/Version |
|---|---|
| Troj.Win32.TRX.XXPE50FFF038 | In-the-Cloud |
| Troj.Win32.TRX.XXPE50FFF036 | In-the-Cloud |
Recommendation
- Make sure to always use the latest pattern available to detect the old and new variants of Sodinokibi Ransomware. Please refer to the KB article on Recommendations on how to best protect your network using Trend Micro products.
- Make sure to implement the ransomware protection features and best practices. Please refer to the KB article on Ransomware: Solutions, Best Practice Configuration and Prevention using Trend Micro products.
- You may also check the article on Submitting suspicious or undetected virus for file analysis to Technical Support.
- For support assistance, please contact Trend Micro Technical Support.
Threat Report
