General

  • Target

    KU9xYWyM.exe

  • Size

    116KB

  • Sample

    201007-v83h9rk4nj

  • MD5

    3a065c873f2e373e2aeaab748fad9d56

  • SHA1

    6de8ed95338ac50900ee1dc14f9fd2d338a5a9ea

  • SHA256

    8d49c283fa8ca2972aa06c3652da6739965900caf47c0d630305f9d0f3fe6396

  • SHA512

    96c275f93883225a7adddaa25777b524baa05c05be16d3f6aa2ba1fd44fc0daeea56f3e72a64330884caaeeae43f50d3d411c782cfd7904251b056930e98cdcc

Malware Config

Extracted

Path

C:\61n45o63d-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 61n45o63d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C894BBD906C3A0A3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C894BBD906C3A0A3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: P5hJgatVKdOh7gsouMKZm1Wxt8F47H9xqffRumsz4L787ZU/iMIr6DcUEVOvC/ZZ Baaa8tbFUJLzzHLsaSwN6sjZWUldEvsRm+9pGmIIIAGyEETO4VVQCiK/CIVe2IKq yayeFny+5mVSg1b8pDRvDB69DPGxfs/7IYX0E8GXwoIg/53SXVDu806UcfV3mi2U Xt5CVsvmf9dR6L2zoNdA69L2AekdH5k7NAT0eqkfNYi8MYzcthymYbI1GyX7d9X3 D0MHymKiXOlK4+7FAQoi+ahAS84oJmlgJ/THNClHVEB8+JDMXLQEpjFGmdJKiz/u aw9v7E3iPb6UH/+BXGqNboGQJYylJ1pl/AkgW+1x9NBtfXXPkTUZj5mWoM7fjI0p 0c6Hw4TtLYVCwaY4aFifv9elqu0ZK6iN/DjGos54p7z5r36yV/+imgjAFELrwITX wUIWmudOkXo2vxi4orvcrw4WYnlR34bpjUP8OPCz39VQOchjqA1fIFopyukHVbRj My6SIzw0D/Qg4QRmYErKjXunyfoldPMn+ldF/7W82t7rNN5Rmnci/so1rSQtTaSZ +Mj0Np5RS+EyFVBa9YNlg4/zFpJkGyzibF6MxUD3JS2LA2aNtPk0JmCWusJIWe8Z usrZDcFwjAbhS8aSeZDWU17b13ZxwBT83Aza5MqKHVwWjQdnNVLMR1SGe/FzVoIV Rra7ucyNnLSrVGlfIRDHU8kl4brmIJ5tNpzogGJJmQFD4Wpy10Lt5dPbXvSQqlNQ c8kUK6XQ/9ZoyiNiVPg2pf0kmfYpeuDaCaEyN7PHG+TZpWAjh8Ey5q7FPgSua9Du aNhfwt8fMDv1a7riFn8Xmb+8jGrQbj01L+LGqEBZX/fVa8aIwZV6NL3jhQEa3WyE PdG7crw4ZGq6esRMWD26hQi8IjEljSXRii5gDm0OG+xL9ThdM/lPGaG2VLknAqLg 3Y4WoP4uizT6YGURHxy5hnDzqBzg9U9AuReP8BO7Iy/2BWLCLI9yegxxWinN+ENr Em7Z5/wBIhCj5GBvPwMFuXmyvXYt2G73XFIHrFKMg4G8U7tDmJ2jefRhEJ/IJxuD zI+/xf6FIsqXUEdFkEbs96gpfrKOBrI2Xhk+rPrkUntGZPErxaOUg3j43Byjk2Fh qOJQXPIUG0BfWdMeJchyo7ZbQwHXkTl4vhlqTa6CE4FAnPnKKbno4Scaj0uI/W/G k1H9Q7jZdxDtcX9p1A11pOU8ETG4A1I/8DFjEcinyOXGnCS0B6rcUeXRBswuszaL UkA6RcksQD9MACL0BpGzbW4V8hP8Cg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C894BBD906C3A0A3

http://decryptor.cc/C894BBD906C3A0A3

Targets

    • Target

      KU9xYWyM.exe

    • Size

      116KB

    • MD5

      3a065c873f2e373e2aeaab748fad9d56

    • SHA1

      6de8ed95338ac50900ee1dc14f9fd2d338a5a9ea

    • SHA256

      8d49c283fa8ca2972aa06c3652da6739965900caf47c0d630305f9d0f3fe6396

    • SHA512

      96c275f93883225a7adddaa25777b524baa05c05be16d3f6aa2ba1fd44fc0daeea56f3e72a64330884caaeeae43f50d3d411c782cfd7904251b056930e98cdcc

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks