Rewterz Threat Alert –Sodinokibi Ransomware – Active IOCs

Severity

Medium

Analysis Summary

Sodinokibi ransomware usually targets victims, infecting systems via Microsoft Office documents. After encryption, a ransom note is found on infected systems. The ransomware usually demands a ransom of $850k or $1.7m for decrypting the files on the target system. The ransomware has re-emerged in cyberspace after a few months, earlier campaigns dating back to July and August, 2020. Recently, few samples of Sodinokibi were found being distributed.

Impact

• Files encryption
• Information theft

Indicators of Compromise

MD5

• 1ce1ca85bff4517a1ef7e8f9a7c22b16

SHA-256

• 06b323e0b626dc4f051596a39f52c46b35f88ea6f85a56de0fd76ec73c7f3851

SHA-1

• f35f0cd23692e5f5d0a3be7aefc8b01dfdd4e614

Remediation

• Block the threat indicators at their respective controls.
• Do not download software from random sources on the internet.