General

  • Target

    8cdc6c54e57c51ca7ed43f1f56e09b352a8995a6c49dd163812e8ecfe03c613a

  • Size

    341KB

  • Sample

    201020-4p5aq12fv2

  • MD5

    14ba7d3a1d28d8039695d2035182959e

  • SHA1

    29c653f5f95aba672ed1110d225d1780aeebe4f4

  • SHA256

    8cdc6c54e57c51ca7ed43f1f56e09b352a8995a6c49dd163812e8ecfe03c613a

  • SHA512

    a75f79f92ab8fd5b337b308c6476509e4fe4b06b93073ffdd6c04ebf547b6a77fda73a6f68286ec403b9d09f464467215738bcdd3ac021155a00de3d04fd7b44

Malware Config

Extracted

Path

C:\035i588g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 035i588g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9D740AC6038D38FC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9D740AC6038D38FC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: SGrxZ4AKSqmEtlQOIB5035gsnQK/NF9jwR2pO5cOdqloEP1hK9pLlPT2r78Vt7vE sOBFae+tZitFkMzx68TLb3q0gxDKwUUcq6pUYS5RTM+zu4BVDZf+Ptvc0nZ3rP9S sO5jsJxsOIZDF7rVBr73x+oN7Ull5x9uYZhEWV1nhxupJfwR10QxflCHq4DRNkud KlSW9+g4OmnXUVtGXxSiORt6TAsdXH33OKxtwEqHHY7aaj7DUuoqhs+4Ov+Z+Pan hBEqAUlkqwcdPS6fVAGfFSbFt8M1OJE4UgngCZKwVDW+y/OYCAuo2WgPYQMA37nR cw2oJ9xFiVXA0w9akd+bmEKoC2z6i3ic5T1Fgm4+CxUBQmThZbGZFyVakKpnY3sg COuDvW9Q6hPEawLRX6OLm4gAnR+HdzqaKLMjxcPwUfaI/R9gyNTW9kHEQFKgi2oC /bSnjxFOcmmLneed1fHNNo74FPwYK0D0wQ2OR1CqrokHjq3NEz4kzO83lPeS28uD 27bxFKY1JU2OOTGIFUtxjVYkgw7M+TUhMkjz6AlH+ZMcyeExjPAhSrms1UtUXFL8 QLu/Q0D43LvAsuXV1EA9JCtATv53wJIneffq0xIlTJdOQTWdKCQLBjGI7nxPjzgr /dn9gYJN8RPTZfY4F1xx7IsvQrFH1jBTL1p+bZpziqUAzrq7x6IS8P2stvMTsdHw JFyzRTOLxYmbwsikwgO9aRJbAB79dlbeoieh300BRYMAwBqP1k0yBrfd84fRz3yl zEr/zneimebLTTIFYwcQgy2191FJuPiTMbf9IORvFViPhBGFHVFhmuPv/E8h4e7P Ks9aYNYin9kItVQaEkIiZ51ZkBGiPoXnSgPqxiVb4HMikWsuJ/nHsVbWotr9P+Iz kCyc82kmvloy/FE0M7ePHFoao4w8V1C1THBgVhxNfjcLXh9dbNeG1gTxQf9uql9B k46JM4qP8Uo8t99uiMGmgAI+YDVZ9cTnrsyAD165DoZjik76IbDoblvroI4RlKgI y32knskAPu2jdNE1xkjyPwmEQtWPOqDv3soYK1VpvSAiy1klzNrTiFUCdkD4QRRL UuOaDr0prrr8n/sDX0BnJDM2xQ1OWN9OmXwtteAVYTeedkh30A422JVCgfwGMKmx CRqCOaUw/mTnbdfHVeLFSJFfBLIs5bFQ4YVeIMYojGLGRud70bdISNjP15IQZMRI onZp2YjjNu6Efw6vFtlIgVusUbgtE0z5gkodEw2JnKnMp3oLQnd1fElnmV9V9awm ovProbtpXTN9OAIxDdqgMErVQ6g= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9D740AC6038D38FC

http://decryptor.cc/9D740AC6038D38FC

Targets

    • Target

      8cdc6c54e57c51ca7ed43f1f56e09b352a8995a6c49dd163812e8ecfe03c613a

    • Size

      341KB

    • MD5

      14ba7d3a1d28d8039695d2035182959e

    • SHA1

      29c653f5f95aba672ed1110d225d1780aeebe4f4

    • SHA256

      8cdc6c54e57c51ca7ed43f1f56e09b352a8995a6c49dd163812e8ecfe03c613a

    • SHA512

      a75f79f92ab8fd5b337b308c6476509e4fe4b06b93073ffdd6c04ebf547b6a77fda73a6f68286ec403b9d09f464467215738bcdd3ac021155a00de3d04fd7b44

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks