General

  • Target

    735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.zip

  • Size

    191KB

  • Sample

    200917-knsrpj4cl2

  • MD5

    2c2ca8ea86a6cad878a3e0cc8795119d

  • SHA1

    39abd770dd7984e01d58aea96b9da8b3aa71f39e

  • SHA256

    c324b74a5fb1fdf9e34780cf3f6079b23cf3b2e52b422cf760d8bee7090b3e72

  • SHA512

    4758ece6dbc5afec1f454bd959d236e7d1901344bcb0e16b6459ec905f5f1ff4432b328ed8fee01253949055b1b5be82e68ce1492ddc006667504aae5d574055

Malware Config

Extracted

Path

C:\w335i-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion w335i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2D4524545FFD1B6A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2D4524545FFD1B6A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NSrvVPqXbRm2nFUK8CPTFsjt7t3Xn+NZ1mk+IOkSe0aPOX1KcFAZ7Gpb5PkLeuuo 1jj1Hq/uNZ5gKc+MKY1UGbhS3xPWEVkrJVrBgY5Vu6R7bb+JZ91Zz8/IpQkOHuEE wbpRnCqWfc4ZhEY8xaYiPL1f+/iah0yMvcnqrGmYrvx7jzD76eU2Wd5bge9MQUlR 0UrloaCbYd6bP97cShx7QcGuZE8Vc2PGqPzfnh+Ue+tqdpwPW1pjQ6yWlV9r+vR3 FE8o/ua/1PxXQxkqArgfLfiyT88WadSgWYWjEyBeGz0Wr6MOrZM0TGrO3iiyBDpq jf+F1JV0R64liwcJjERsUVzgm+GUi3EZSHyje/oPK1Ug6scGiVUIcVcbpCwPxyAg l4yVZ/iVge9xwpoCdWoWTz9J6s0Y2hFlTh4cTxZPPk+K41Lp32/lesbGoNzMIBl5 a3r/1up3a1uGlA8Nzws+R+X0u6cZLuTRYT1id7z6QcqDXibMMLv0SZwtDDbobagu 8koVJQzXjhcG4j7ia16GDGsRuu25YlZFwDThJuWm+GsVF3VPaGNUg7cZT3mkJaXV 4/9Qffehw0mhMiHfrLY40EtI2OcnIExugmNlYGKTZKezuPnb/1QdKMU5YoE2bEFY KunoMQwFZQI2/DE8CW+paB3Azx3wNRp6ba1AWqANJ9bQzB2XCWiCb3Tt27JlVIgv +AbFVYUdNpRmBomNiUXwXMCQYxCdfmrf3RFbcEBXY713oDBlxxqwredBJ14DjiiE tU3w9LPsOzCvJUUAyJIERIW9/7hU6yM4BdGeqNVD+YnlceYpQYg4PhmzfXo4JLdX 4WcYsmceoGVd5ETuZZoHm0qX14aVQcvpO48ggtAHlzWeMHPHxRgbtmRh86CvpogV jd+Hig2bba/snuy3QCZco8KisniNv7QZ1YPBCevrTEspiMSZ358vpOy8G5y1beK9 Ut3T4sLTO3N5Y7czv0v74yQ2C1TQhnA4BxWaT7KxZbR0ueTnZ7g8PEjvf+/ZUecp kYYmV/D6wpYk2n19KQKpTlIXRFVdFYlMKHW+JdQg5UteQVi0WR5bc56FhFOjJUAe f4AYFvYtmzls5CKG6KBbI3AtGDPXLYGI8xdnaOz9+CmN8W5B4wJC80NkRk9zo6bn jqwV3uzAJ4lx4KVtzY0zs9ecGqneQwEa/t1hvoMQVDOFtZUCvcx7JDTLGxM4ZWXK vTTlbWSGeMG7mh2TSt9O/hP70DrcTn30UN/5AdEV8I6auYNXyGxuUxE9Ydw31/55 Ka/CZmKj/yhTnw== Extension name: w335i ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2D4524545FFD1B6A

http://decryptor.cc/2D4524545FFD1B6A

Targets

    • Target

      735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe

    • Size

      324KB

    • MD5

      20defcd42cabf5da27a21dd342e58068

    • SHA1

      408cfabc99c350ad28def5475cfff5dc2de02543

    • SHA256

      735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c

    • SHA512

      8a6a2f462b9e5ecccae13ecf176c8d2ec93e1c535f3541aa9a39151ea7874e730bdb627b422fbe2ba1c51c98c9c5a2b35da79433fbe9105038836ca33f31814d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks