General
- Target 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464
- Size 175KB
- Sample200706-nc5ayyph22
- SHA256 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464
Malware Config
Extracted
-
C:\52hi0-readme.txt
-
sodinokibi
- ---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 52hi0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AC61F4D50BC89641 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/AC61F4D50BC89641 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NzK+5q4zylglGagsfoebadpqTdW3omOTylDzcsfuT6Lot81uaQBuP++XVxnMnMW+ eqDh750fCUXprCdBwC+QOKuAbAhaxvIEl8uM00CDuOAsnjkia79TiSTJSDgNry8k Nw1x9DlhFLsbmhDvLVBADmvPJPL4RrL+XH9tCvGzdveIyHddF2U5VFP3jfemJeF2 BUm1fUtSr5mg/VdtAgWBvnnxXD2P/CJZPuuZOUsSTS1tHdS6vyvZe4C2j5vqWG+d 5ghPy0PIDyUZY1NTCMMFen46yjRg5QguEwOdHHPvJ3NTQQormDCb+YKftXRaJcLS YqHdgcsbcNyw+KBi0HyGyCCTXxwRoEUnoutq/rEtrt+cX0c5m0tIQr4E39gZWQIo rY+JF70UDhL/CfNF11NGL39s732ixRv1y6qgxjwYvbGBgvuKqtc07pPDxd+SeMtk 34f4pGopf+TvjnpqNFNaKXBUHkr/nviGqqH2mcMRDZp8uxV0LzfQ1fsrKeGwrw5y VdNoIYpeNPOFemQX0x2wDA4GUtLG88Vo7JLGrrt9mztfJ3w7jPqkgf71APa6QpjB As8H4qK0r+qZmny+MFEqg2KFN1p84Hh74h5IWNhbJqRihR1WAM+3yW+cKBzZTsXd Ez9lmomssKckV1TGEX/1eNN5iCgOEgC6RvOJ0WQ2aY/Vn3xYnwW/apjNjU4A0kYn aYH8Ykbca+8neOLcSy2IHsTkmozpyIwGEdECrJvJoPMSnV43a5JTG7bdYeJBepm8 dIUEm/i2o6GRBN9ucgZ/9RbNh/yrZWlfuWaR6xR9/CsWZASCOdZzUjwbWL/Sv91H AKbO4Ju/8z5RGMHYl8Q5XoYJWh8ho1k96Ora4Wo77bxKVVEnT5DjM1YDgGoxR9qt Xc6IzSkLgOMfMEj+vUe5k6SvEV0WxE2QbFYoraIwZPeiFsaHft3a/56oK/ZDrRjY cnU6HrR2mb0lzLjKjg0zAfVXhAyHIbpJbNpvPfRp58Ok4Zq6nZSnRdKRD8CWjzKM +d72Vfh7cgVqQDO2GVhAxhfAAMaX2HZMcbkFc8CXz72jzZ04+7czYD3VjqbDOFdV waJMdzBcYp6jImy+ZQoqU3qtb2ZM6bdHe0gdXmrxJGfWOfCxtjfXJdAN01QdYOJp Z64Iplz0wpd7J4tjBphQKnujK7KAGWLnGhZXj6nVJMnbx8RdsstA/WrIjyFZU36y CJFz2a+qztxUaODanT+S9JZ1eZtfj9Zlg6lbcqLJoEysrJ6wNvqGM8xs+QNAcm8q RnZ03RXC9CQzB7kedAOI3YTog0dDxd2jGuKvy6yf ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AC61F4D50BC89641
-
http://decryptor.cc/AC61F4D50BC89641
Extracted
-
sodinokibi
-
patrickfoundation.net
-
stopilhan.com
-
johnsonfamilyfarmblog.wordpress.com
-
bafuncs.org
-
forskolorna.org
-
wraithco.com
-
bodyfulls.com
-
epwritescom.wordpress.com
-
gadgetedges.com
-
commonground-stories.com
-
brawnmediany.com
-
webmaster-peloton.com
-
blogdecachorros.com
-
zieglerbrothers.de
-
erstatningsadvokaterne.dk
-
winrace.no
-
lubetkinmediacompanies.com
-
berlin-bamboo-bikes.org
-
delchacay.com.ar
-
cimanchesterescorts.co.uk
-
net
false
-
pid
$2a$10$.f7IpgYtYZGmT5sKVxP4DeexwfYEU6ILqgG3IL3orW0F9eevOA7L6
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4769
Extracted
-
C:\e851243h-readme.txt
-
sodinokibi
- ---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension e851243h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/07E59509D684597E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/07E59509D684597E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +OR5sxhqvtlbCQOMAF4dqX3p3L5ulyX17P/W2Tc4izUiOF9k+eoDxTHtoGWvw47r crIaFigN74cui4/xaaqHxeAQDANZ30+Cwi4fCl7D/uwRXMuyGF1msS+KtmxEX9l3 mvmn1Ydmyh7GiQue+kbqCu1OLnIKYzrA/aQPYlGzQjos/E21DFm2l7ci2AGuqhbx gYULQZRFIkSML+B0rEqCovL1VccWAXknnzi2PnuWTW2eMOtWhARuUIwE3RYX2GKx vwSXJ47ymnQNJJljgOvp8YdwQTMx06A8G15q7SkdA6duOAsXPLBa3BYp0wfgqVn0 JiJd1HyZ5awKWUnkgI9eY22OUJS8jL8q0vy3NKg9x+rM+F9HMI5rGR8Vx2LDflm0 dmXHxDHRGDR+Kksx69BcF1kccqDDtdcmpW/+nlkjyjDQtKRPu81pc0nbnZEJMLcp RcJ8m3hn698dmzpBbaOP7o9xW2oelf7vdLDnBB/JsdDSoGkz92D/RcN5CfRFXxdw otvUol7+dpfe19LqTytc8sNffWGXi+FIJmPjXyjVYH4okrYx3SS1NsndFOLaj443 erePtpVsSlDdjnriRUS5bfG4E3TQgvEx57ln7OOGqxEavpzh1aC5cTKWXr+PfuB8 pUbyUSBrCY8d4A68rYFvgBmi0leQkDdgu+waKSv97xsBxRuMTMQyEkfHMMDGHP1S VlU1e8/TkK76ZOxmguWPVDrRIUsjMJJMahBFEw8+suIwpC07m4Qt4eLP27JbsEHw aTZGaXvAYKWsfRt5x4Bowbtq7i/qRlF+g9AsTlNQulzMHyQgbRMQV4Nj7GUjMujs JWJOOBTY28XISxEuqwqFjvVrY9nndoLJftW3lXauO1oBa3Kiu+5RsbtFz4xtQF8u IbkEDkT7gef6pr12WXSPTtMzyoJJGjkrXNUAop4gGnd88OudXyh5sxYKet8W81vn Bh3ZYnRKzZf4X2R3HGhdmaXXPC0BM0j8w//h9HScd7a3QHpuj/I6SPyQyuu7IA8N XZjA7iiii5NmoMiQHj4d5tnEmJZmDDrdxvcTO84dhmyH99Aw2PQMKp5Wbr56d/dR lDMidJMMS2HAXTzqcBwjjNEsSq7QTV7IjPxWMc0kviHFm+sNUy84rM2FpuWrJ0lA cV/Oq0dykAFcgN1HLqn4e4Hr+3xomjgYCrIlLUOqTvFFUPhYljMXt+3dTz2YlsCQ mYiji8C8PGIOA4eG23fy9wkez0GbOdSR+U21100YK0RIYXW1axzHKJTaaA/l9co+ SRZlwE98OufF2geKMMrnZYB6qBs= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/07E59509D684597E
-
http://decryptor.cc/07E59509D684597E
Targets
-
- Target 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464
- Size 175KB
- SHA256 7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Loads dropped DLL
-
Enumerates connected drives
-
Modifies service
-
Sets desktop wallpaper using registry
-
Suspicious use of SetThreadContext