General

  • Target

    3cE8g42z98.exe

  • Size

    213KB

  • Sample

    200727-x1h682z3le

  • MD5

    25a50b573de8f82bf8d5b29386fb94d7

  • SHA1

    f9914b360284b987ab21f56aea9f6153fac23b84

  • SHA256

    8dbef5f7ffa96759bd395938ed385c8cfe991f96402f900f0a571c844c7fb78d

  • SHA512

    33e537f237542dad4c99ffd31f0930de7e932f03a3b6fac8057760a6ec72da2977c211ace603c57c98e2515a14731e8696e9ed06ffd8e71212918f5768e35c99

Malware Config

Extracted

Path

C:\7r57vg2ol-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7r57vg2ol. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3E42D37D77A1BEC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F3E42D37D77A1BEC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: YQFml+bBaIsdDwtCE1Q9gYkaXOQVbTg/18DX7l1Fs9upXJDS51HNQpPUkH+WDb7m 94xklHGr03x2Frw6rkjVsSUiis9F1I5p2Fnd0RsJ2VxmbPu8kGTeHcpecuyBcb11 BEIz3iOG+MlnFm8PmwnumbcyTo2Bjv4hHjPIK+IFDrZrM+5Z9z79urvOa0wNsVnC /HuK5We0eoFOMM4kHMVTVJ8FcZTGtMdeq5Nyz+51lRVnti5d8zMAm0iLDB/p7i6d aShhC6BTv8A3smV4G8YTLNRNFHlwjeJ+M70gH1tewXbf0I6izW7/0kYgS/5p7iqb aaQN0dPvOTZ8Y2EXI2vB+08pauje799Ox2TDui+Ev1tRAmGXyFvPlL6s3OLvB2zk xNDKjEE55pPIl9WMY8y6UuzzjCsANfx9ub3I0iH0VvMrX76uiJ4bpzRuZuN+hJ9g dQbWY3qDwm/0xLSO8zzWED83VwVCChl1AKp7H/R5FmECOCEOIm3Wck0b0K6fLBrj 4z97r2u1TOVOu5zAGKmIzwykKzho28OhdvPHuJ7l3IQYIpj7wY4dPpS/TOK9vDOm tbsi/Bufeota9IUFk3lO+oDQMf9Dg8nYe3M29SI2tVLagqsdx2L6itmu/LY8qxAL 963Tothn/jaqVmwVsG7QdeTuxGtzeaSph8BRrFkQ8OetnRLz9CCAmZGjl49/Sx5l 6M7Pt4Cb+IDh5S9AUhmWHTOls7kJleslxRPIfyYqDIJZbcJuPHJ5HoG4Ltx3aq6B vo1aCL1q3HZCq4DDBLEo7LgCD4uVMagwrA5t2Oxz93VWJzZ3ayYa2Hv7Xapmm8g8 PTxeeYUgiOKrklhbpaMJwdsFQvpb3aN8lW+uYvong9YbrX4SSl7GwjSAe/SEuWCp 5/zn4ZObmG9P/KVYUe9Au0VwTvfK7TAYeH/TifMewdStZKpx4PljhucCC6cEyqSj SPjNqnX1yBaoWC6SQ0dl9wwqme7cDKNmfGChBh9cPlY3N+ZrndJyQh5+2GggCmC3 56F6y9SaPig4HMHtMnl9QAwJiDcS2XyvJhDGKpfgLYUWQSa3Q9K4Cdc23wQnxWIs XOMeZqybmeZXbQYiP+/tFP2HE3FqxDUIyFUjFmJzgzgXkTZHQ+OwP/WV3SVn2w3Q qNmZQzM9GF3xV3WyOP8eCUDH9e1YyH7kokQuvq9f7Zxhz1hl54tIcRNeopvNiWXC LnbpjfsLNZJ/pB3eipASi39atGwoQlvJDMrsRmAvz/kD74s1Je6KQNc1vvh+ekGp ZuU7nnZWJQSUvinkwhewbQt2IkmIx6gY32Pyx5mzXH3ZvT5UCD0= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3E42D37D77A1BEC

http://decryptor.cc/F3E42D37D77A1BEC

Extracted

Path

C:\yt8y01b0y6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension yt8y01b0y6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE4A73E969A070B8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DE4A73E969A070B8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8+Vv9/BTrPwdJNnY0KQA6lkGDdj6amtww57dIdPuA1c0ZyFshAnvq/+yipAhRb5W oivjmTXuFOFKXDqe6IeP6D2Uilt1NlfJmMulCR6XcNgZpasOWNlHTrXHM3nEFbCx U1i+UMUqWRSOAKBv5OpsdA/qS2y9QIbNYKqlfLD58ZN23ZFgldiMvbq6joqmWVSu 4kX9fs23Sd2gFn7AkN/rqAsMBaQ+F3kIvPm5zPbMmQ7R1XoVDZXyHHAqP/EUxxV4 5hrQz5xP52qTAbTH65ul/FfAHU0tiHXid6YOzP0D63pFzTpz617HetsKFEipnNjG gNVSvUlIRSCAJTGASKdAkNf/TKBKX4JbQBwwZJyR73mmAgmjiK/omUSHCDv9yR9/ cB00TZf5bvZmM3cr5dpLvqScOFJzeaX2ANgWWBLLlQoZPZ/Pgnbgyke8wMEEmqh/ vTO2Tzfk0b994b6+pHHsJd4Jfw29M5zsYEzR0RJXpzhlFIW4oriB9PfG9/Pur4zy VHqd7yNcwfa/dAmQgFayeaucQmVUpOX4Pdp849ck72Y50TSzoUdWWS0lZh1rGkPf OCgj5oiXS9wqhwYPBr/aWeA5a+QHbceIT1uAaWf4OtvVEcj8CYv/HLe5W+kLxNUh YbrcVqZJ7WQHl1hlLAkvcqMoZiytddykUX5oIXwgTeOBDMqjB/vGKjiuiQ3ouWSC B4igfkU25SLtQxZ0Vqef6tpS4rheYWHXYvMKcUxWPbovzlxqYCTVAajMyftS37GV L/qo3IgGD6ZgwiCfzL+Jy+udUNGD89t9ruuDt7n++rrgaTc19CqKevfhmsRvgey6 nbq9QiNYsJipH2aCUzOO21koZSGkMGF4rqNn2Nhb3lFHqj6AHpBg8PROUU715LmB ZxdsyFHUER+H2OF2+dJTHCQm+MmzMNlH7JrKmt2CXApxJf/QHkboINGDN38vu3GE jtjwDCalAEexyZG0tcsCz/SehaW8fUZ5t1bpHkwr1qsXPQdmvMu2HTF100MrpVrf QeraVFCXrJu8i8HVIZb1m5R0adF+/zp6STj4894/waibk1Q4yh3XJTt8ZO3wvCX4 cbIhkAMJr7vCbLF49YCgcWsPqEqtyA8+/+kn6ZM79xkANAuaaf1hQNho77CXYyyp 2oQW0bZ96e3o4QQdU3Qz1A4Rj0yFQ1luLceY0lwQpTg6Xs4BP5pvk0ZHi4Vlru3W LSggcdbXmlJAcb/A7Mcs66d+B/mQ3s70Da1iexy0bbqQeMCwnDZ4e9hrMFztFIhD sQWyHByyuTiaKJzjJgLign/jve9CRRfU ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE4A73E969A070B8

http://decryptor.cc/DE4A73E969A070B8

Targets

    • Target

      3cE8g42z98.exe

    • Size

      213KB

    • MD5

      25a50b573de8f82bf8d5b29386fb94d7

    • SHA1

      f9914b360284b987ab21f56aea9f6153fac23b84

    • SHA256

      8dbef5f7ffa96759bd395938ed385c8cfe991f96402f900f0a571c844c7fb78d

    • SHA512

      33e537f237542dad4c99ffd31f0930de7e932f03a3b6fac8057760a6ec72da2977c211ace603c57c98e2515a14731e8696e9ed06ffd8e71212918f5768e35c99

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks