General

  • Target

    revil_6450906568884224.zip

  • Size

    207KB

  • Sample

    201018-qqx2ztpeqa

  • MD5

    2355b4e101f8fe2c7b1f40411d829528

  • SHA1

    a1537f2354c7b713f65c36cabd753695eb39cb70

  • SHA256

    faf94b3ba043e0d4b7463497b69690938f8ecaac9f65fb972b5b1f6bfb51eca8

  • SHA512

    6d709d342d02ecfaaed7f9410e198ad1ed1e8c6059239a7adc45d0c7bd1cfeabd2f1c1e04ee87cbda02903df64d72490d40a176e7e8ce35ee498b211f7e9287f

Malware Config

Extracted

Path

C:\hc772z62-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension hc772z62. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8EF6786BB5156AF1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8EF6786BB5156AF1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: EaAzS/NvXXGAvK2tbMoEHYCzZEfF0tlkfkPhFouE2Krcx6MqVrZKH0a4dlRZaTdX aONAMxZ3789zUrntvnNBDE7AHXwNNscxzIj44JrWuvrlRPc2Lnb1H6uPQg2836ds FnD50Pc4PHJ+7oVX6pD4RENn/hGugNPo0yZmUZcQUltD010awuf4jeTkMdgKRgwE XWTP2pxBRPops5L5FkU5vgV/mTqUQ7V5AbTee27P8r57VxMfM8dKELcNi8B35FFo WsI531d2jFV5Y+cuwCJmk0dvzTRZcr4GOOJ0fHjaQyB2Xx+QboDhc6J2AoRvqWod yQO584feVJkvvasYBehHC6HRmoSTTY4x/KWaCtFcoTvZy5vcKd+DLSXdGeE2qiok iIYvh0OcYA08iz0D6X7NLfpAjyfXDTkjFMYCbnCsjR4KJaS5Z/5WO0TOZOiPTnRN KNcnXleteHq2DFspvakOCgsTley/6iu/lZQ1MBq8JE+0JZpS2nLZbAvUxb/n2WIG 10AkNQZ5ZXUgh97RqzkriIv56FzUd2CKnhOpB48WJiqv0byaEkqqaiUfc6ZWYPhf bsfgIFQXcnb9GJTz2b3ODRs/y5kU2RSDNsRlmYX73nQhGymaWdLo5CzGlKtQSvLn HXyJyiTYoQ5SOM1uf+sf5Y0sC4XkTgR6t9n7VcHB21N5NlxvoFYh5PJ954e+5ItI dmqyGERRyH4lsNnftANuOqkxRKWWRMHrEvqsKsv+K9wyEyBBhAy0tzkQjGmAcKcr oIRHzliCcOWrn0bZUCazUcYTwqj+TaSfVX7kwtZyG3Ts49yJLz4vfTUe4IR7dr++ JnDceCv2neyn62/05ZGaT7hi5j9h/vNBafywKKJMESn7C3QVBoCRCxI2e1aiZvrJ bcbWxX449/zKaJWuMjDQIHm1ng+htASQCgceGamwra5NMoIoxrMbbf1/yUaDMx73 DXGqdXPoCFIE/1dD4iG5Kmjr9HPiW4/6QeOdBQXO5VUnvvutAANVZjbqir97kmu/ EXSNk29hRg5o1xncytdmrCGkhIdJs+FGzOrH4AtyNat25Fqk9i1eoKGnsi5BSJeL cCKtwfd6+R1Gldt0xGR3icclaj1s/dqLVn7qNJnjyoV4u+XUGjZaVfCwZBb1np+H VoF4FifNT8HXk19z1LczTXuoLkrDqRQspxjMAYEi0va2nfy7uDMjO8ZR2Yeua/uu ubrCxkNFUxxNfZYIcPnjr4hFpg0R+DQRL4ZZZaInNR28DPQ33g1cTY1nwxOkhnRC gebsF7bHdhaatoZgrQeHkVw6ls4= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8EF6786BB5156AF1

http://decryptor.cc/8EF6786BB5156AF1

Targets

    • Target

      fa7d2020776a080d2580c0cad013be84484cbaa8d927fedd51914bad567d3278

    • Size

      338KB

    • MD5

      d44186f7b95ba487fc1c54a05d68f04f

    • SHA1

      f259705190dc78c7575544f22dbaad9066cd3f6b

    • SHA256

      fa7d2020776a080d2580c0cad013be84484cbaa8d927fedd51914bad567d3278

    • SHA512

      5a14e02a8cf384e73ca115bf7ada61625c06453a9123d71a55f9f25fda21d3551160b21b2f1a47888ae2e54731e65315c46025dd99b717ac16e3e1fab89a4ee9

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks