General
- Target fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
- Size 166KB
- Sample200720-gpkbnv7ql6
- SHA256 fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22
Malware Config
Extracted
-
sodinokibi
-
lorenacarnero.com
-
resortmtn.com
-
haremnick.com
-
allentownpapershow.com
-
idemblogs.com
-
toreria.es
-
boldcitydowntown.com
-
teczowadolina.bytom.pl
-
faroairporttransfers.net
-
rushhourappliances.com
-
mediaclan.info
-
digi-talents.com
-
xtptrack.com
-
bridgeloanslenders.com
-
gopackapp.com
-
rimborsobancario.net
-
almosthomedogrescue.dog
-
forestlakeuca.org.au
-
tenacitytenfold.com
-
theapifactory.com
-
net
false
-
pid
$2a$10$umiybwuiiY9i8r8VBXSOi.CXsHbB0Zx3GSd8GbYRag9aFCNsAJ43i
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3979
Extracted
-
C:\3z0k6i-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3z0k6i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C2A8A4171253212B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C2A8A4171253212B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: o/tihtdrhzaQcaeIWOXXJ6FUxsN026k76mK6Rp0rpNxT3HUtD5cgZSLqaq8znKx9 NjhRsnmeofOKpWWeXeMrZsz1eXm/es8CkKT1+kFZoAY/kXT2Zvs4DvTIBwpw9COy LXVKvcimJT/FAH53GGLFkuozbf/eQ7Z11Ugy7+IP8mhb/Au4rKQjje85lJ+2DDba Ihe0wucShyna4qe8K66vuEzwOTpLuEVc1UChpBqudWDEqU47qmP27rCh0GzFIu79 9Fk3l9p6o6IOtuHlXmJ31HTGVM1IfR5r9wv8tx4tQXuNZoiXvRR/J1KVqs6fAgOT V9wM0DCwGGN3Lm0nrDOKYz49pgXpXxDc9Al8O99PIdjIkbsuxujDWkZj89PObBs+ uJH9r+03/tedlUY8CTFxgIA25e5cLWOl3gwIhMF+G70Ja9D5rLrEx/sBPH5iqnxK Q14t5dNoXSlnMWOqGqzdxdg9R+2gWU2drAkAh5bHdF4eIhegxDJWk37V9UKYVHwe 4mpblY/bc8dF1ohEfKpvlKzEcIZ2MbFOzADQQ05mjjTUdnxbohjRb2MdFelv/by3 bqo1HB/+5p6LNM1qW3h2+Rev1oNhkSqp9qAnkemiAjVB4LvT2evuPSe351whArSw rXF3xoWk3/m+im+YoVixMwb7Yb69DpZnsp9jeNzh78VIf7Ci3pR1W7kL/YNcdwI0 1biTD7uhX6yFGnVkwkJ4X0b7ZsIp/1zlWG3OtYfxV28olaJ7D7/V1pc06yzFx1VQ lpg8QXFsdNC8OVb+loNLRZwXwOXp6rREbUFaQLviXmeiSOV5TRNRBZlhbKxVmKbr c9BWnuB8qC8FawTHB7/+62ix0azjJeIj2SkMWy/w+oAbwCiS/349mFTKDaExckaI kRXaUV3Sc5V2xb4PbcffZ1WDyXCuXMj/d+meHIS4a6qovkFDMVHy1uWz7vBRN8jp oakKJgEk0NRico4Nij7dTd5kj96Va9/WMs7YWqJ1AJMaFCkzWuXJJLR/AO8kB58V thQzvgwOVmLIoJI2fwipnryYdCQ3SdQlmUiYXVts8/kZZe2KOLVEEXlaxolRiwlr RHqu8T8sBb+McM8P8FEfyvCCMhSHkA8UeJBrTSpAnhRPDeXW814qK5W4AWvGgW3Z /vJgxfZzHqVmGtiRRCKZvNvAql5iwm4tufbSYiLN8pIApNzujjWXOikQv/Hkqmi/ HKgcVW6lGf4SaBZGBEPGsFh9uIPIwLZtbZbNhwqLL9oimz1X79eNuzy6/CM1Fhnw wVib1Hx+p8hL5NcIb9wmkqWGoCAJ9zinIPOIRBBqVMI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C2A8A4171253212B
-
http://decryptor.cc/C2A8A4171253212B
Extracted
-
C:\06fp30-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 06fp30. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5755C63FBF55DAB7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5755C63FBF55DAB7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LOgY9TUhPIdz1pMOTQK0nw1wn145t+TlalqSEvnAa7AiPkS5yGTLLCPp1ECioW1o OBkXTAX655iSngyUEdkaV+7UgEHkL7aBza7wwGOl+ue5lU1veRITpvMNQlo1RNds tyFrX1U71+O4Lyr4vShHLi7mx/vMZMXNaH3htQ6/cyRHpfjLec5C5O/UkkZDe0V8 NHbJjlmSdXK1/l9/c8GreNK1IUBbJnNVexXfkdWicbabt9hbRdqUoz75xEQ2TOyV 9gzX0ye61foBIFbSQUDqlqqkHqxT6+Msg6uMsGQn0hEoDyYcFMyvXRuvfRq55Cwm vJJjTMm/e5Bg13zCGnMGeKwZO4869u4K+snIDb11KBA8aD8zzl3Am7qZs9PP+U7K kxmSncrX2aS0zZGVMJNM5Q5p11ZlL1Pch+OzYLbVaDwSmnsmAGQEbBTidOMPys1x rNUnxJMaaVIi5AxwVKhuT8D9IrEQYI/4LmVSKfV/RxCwOnmTAEI5xgF0INphUaT+ gw9j+LIYp6jk2LJIsHpol3NrhaqgUhUlzrPyVuBuaMJ6ZCLmAgphr9DTDWJgMOIn MDZdZDlWMmAtizfrXgbv/fQA6EEmS5FCnz1w1hSAY0aiNo/MBQMK4RI9x6tce+2h ntOdvuyoJXtFpUOHVQ9i8tV1gmMddKOGrBKQj9NKm9mVmxOXVHWVASyLuNUPVdvv WR1FAQLYUsM4/A5w+EQ5UcTK7TZ1sgw19pfRwWtm8f7tN820crCCUNJbEN8hdvpy jEnLplzvyxl8DDMu+n6tRRdcAbay3pM+3BRxVAGFZtR2JMx9Lui6jAtpgntHmEDD 8HTPNhSQFQ7AV0ZlQeDHUyYUPuQ9OgF4oReMP2zTPw19lRLOy9OEsYnETTydZCmD AXzlaJy6UwAthCIqEkiQQEp8JgTgBeccmWGytOF2kIEMmwVSL20FLRyzTSLRHcBb /DP3+halRaIOJw2ck/DyS/oqDkDNkedp0RXpocSKSarmRf/aAeAHYz6+9noS73ZS Gt6K0PlTzq/4OvLYV/c1FGfHdn0RIEqTJ53/Zj54Ggwq3U+dHn8C+LR8wGQ6PHVB P2W8QMUsS1N8nXeTfkddNJ+LqsIG3v7UtnHefNQ+jbrEbQ2Ee27ijlxT9WmP1fKl 3+qcZ3S4jeyXzttoAGTIZ8/lXOXQjkp/hZ9RImA0WqD/MYZKt19ss9Ijnxl/sLUQ r9N5olUCFHqxICD436QgY8gYTE+bjdOuKmokhpAz6fa3bS1Mz9hkcMbN7WNjneDq osIPLJGdEkZc+5fH5fSAIA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5755C63FBF55DAB7
-
http://decryptor.cc/5755C63FBF55DAB7
Targets
-
- Target fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe
- Size 166KB
- SHA256 fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application
-
Enumerates connected drives
-
Drops file in System32 directory
-
Modifies service
-
Sets desktop wallpaper using registry