General

  • Target

    test.exe

  • Size

    114KB

  • Sample

    200523-zvhvk7p352

  • MD5

    f65433e070ed4ebf9272864c16adfbd8

  • SHA1

    1d902051ce0cc6b42ee8048ca84683c3bc09a44d

  • SHA256

    c40cf9d81a2d63e6e32f71607094a859d76bf2469500820e0cee4ede9b8d5c83

  • SHA512

    1a174f3f6505a55d5e65f0cee026255fa50a45b15e0b2574833cb4da1faacef538f23b1761cf40f554b6908570c903690ed3d812a30c3da91d786a158f8d7651

Malware Config

Extracted

Path

C:\51vs5a-read-me.txt

Family

sodinokibi

Ransom Note
---=== Welcome Aurora Cares LLC ===--- [+] Whats Happen? [+] Your internal network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension 51vs5a. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your patient and business contacts extracted. If you do not take action to contact us, the data will be published fo free access everyone. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/790A4FA498118660 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/790A4FA498118660 Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: AzjGLIS8/03aziJShpXLHUainc8vbAC2fdQtciuNo2lwIdsFMMe42oiDh/HpIk5d K9TAQa5khMwR7Aor/Ksow3T0NLwM2bIDM0uUu1ylLFgA+WBsY1i7NTc+MGMHmxsk uQcQCePA6Xw0Hiw373Cnar39ljMUQ/uwLlIMyVjaHkmH7ijMARn9KmIL2rXMDduL 9oYyBguHeD6ybv7pWBjX6PhRTGB/8RiCdAGYv6ppRg+3LvLh3R6HkqXAbrvr8NFw r9qJ0xIBV4HwKX/fnr1p/iYMnqbSf+vTk8YkDpSK0huHf3wQwQQ43jvD09uhqrLC y5+MoDVUZnv5huI3tZvVPAR3XTodAL1r5M4/UQdAAriVhurL+wlNzkF/IF5J6Csi nT8hffVv/7N1dh6okdNsfGcYjxF1m9Nym0rHub8VEa64TTyieQTUxCX0I8YbHq7/ tkchzAP5ROupUjWjRd9oYF+QYOzyayfthFQKZ0p00H+CM+CxtLu3MdmMKwOpFxef cQlIL8tAJ6sATy5hhW4QlulbSpVFMWAu+e9FTwK2aTSvNGiz8kuFVPYCkz2OWGve 8FmhlLksR9z3ZDsKEr0Mv4BN14Z06VUrkL3rsIrckpjJIW7szZ4FVRlgGHzYCIjy AJ2/KxdD61LsyxeQ+wEK+dg88jWrovX/6aEh7Bh/IFcqKojzFDrKwKDzyFI4Rbq6 RCqcwJo8O0HKV+j0uOZExJBLKedd0h8ff2G14TSww8N+EAesdSyvV4bAuQieQfrK iF5oxsDrF16kVQq6WdLrr0St0N3Hh0QwKvcvrRAIgpxu9XUtVbfu8YYgY6efPNsD bdFVyt5HnQy6pN7eNcKhVkJ2sPQBiaW0eYS+VirhyEq1T2yfGAJ9Ml66nj0kG2Yw 7S+BArf7gmrtgQAyBp2O0BIF6KWgc8sCUYMTYqq6wrni/xRXPErZRCNOfFClksda ZQ0OGtZcJ9k/+Dyf9nWyyhIQZLMgEq1xEF2y9dStpJsMSJAFHadnhixGVni5sfDQ 7HeIZbwE7fFDqBVLAE5rTJhnx3TyynV3sVCQzoTrAh+LptV3yASgaoyYlTROJdjX 07Pe3Q5HEQs0LyNQgtk2v2F+kYhUHONfO+XVvd+DsPTTqIduIjweQqJZGd8Z0dcu K9mWUmuGmjAHhene70CSEEq9Vm8lJNhCcvacmxZQaQU9HF1Cb4Mv319TN9taBz/x 2Q54N4XcGBFTajgrbubCcJoL+VZ+GTmzMpiWC21AwbhI3Q9BecDLkOt92GkydgrG cgatzFQjZhr032mG/KaPqQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/790A4FA498118660

http://decryptor.cc/790A4FA498118660

Targets

    • Target

      test.exe

    • Size

      114KB

    • MD5

      f65433e070ed4ebf9272864c16adfbd8

    • SHA1

      1d902051ce0cc6b42ee8048ca84683c3bc09a44d

    • SHA256

      c40cf9d81a2d63e6e32f71607094a859d76bf2469500820e0cee4ede9b8d5c83

    • SHA512

      1a174f3f6505a55d5e65f0cee026255fa50a45b15e0b2574833cb4da1faacef538f23b1761cf40f554b6908570c903690ed3d812a30c3da91d786a158f8d7651

MITRE ATT&CK Enterprise v6

Tasks