General

  • Target

    b7cbe20ae32185b07bb63f96bacae27cdf68e8367a181174270165520a015d85

  • Size

    116KB

  • Sample

    201020-ycgytd4ky2

  • MD5

    da9941dae391e44a65f8df3653fea9f7

  • SHA1

    d356d6fb11ecb659d2bc2ad9f11ccf0601755dae

  • SHA256

    b7cbe20ae32185b07bb63f96bacae27cdf68e8367a181174270165520a015d85

  • SHA512

    485fe792d306ddd2c3362197c255ab8871184f211127b4b5482cb28fb94348c71382367b74a6f0bb9b3807a2f2f89401e7753eb87d543f821c80420ba919b238

Malware Config

Extracted

Path

C:\d60xvis7h-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d60xvis7h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6F35D78D75CB96A2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6F35D78D75CB96A2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DLEvnLcYo2sfE77BIEb6ZnpjJYx+8xTrEe6WortdhEkw5h637khLv4tx00vippbx EGUzssrUtZVEaCcXkCD0MrMkQx4IpLVZnpf3oCNrPUG41dbaX5+KCgiTQnlyjSWt CZTiglEnyQBSA1KkSuO0nICHCUfT+2EQ9uSWvVBwiypdG8zkPFTI/FPu+V6UnLWy i6NqxBSRW70N8jDjJwnMHaG97GDcGPohUH8O3+pQmSBs7Dk9GCp7jfyM+Ey+6YjC X51Wc7FTXWTjJkwK3bl/1UYjhEBBaFUU4cTO7sBe0sc7htHvoQw7EVJusBmHCl38 Bfd35ojmkTd2BIx9217NQJ5EMILS/1UYI/ojkuxUb9vy7bKcQ6U55lzVSnM5DdI7 fV+Himu7fMqmIwqMoi9rpwlT0drPv5S/0V/n1zs11A+zYERMKe9HnvfSnHF2E2UM HVs91MRs1aKsjL1f5n/NuL9ASNGrjjq84nCX8UbsgVsh7hDMXzHwfiRXK0G4Cr8f w8R4puhGQ7uKGKJDf6hZiTWB0LUjdrYhjTpgC2kpShxlxJsA4zNzG3t6MK6KtrfJ M9PjPWsO7T+6P6mf+HmWGUKAmFPJlXKUKAuc1AzFvXvRPTRcX/1Zbpvh7A/Q2mj5 bGTPvuez+qAwlBL9kz7uKkbMVeNqVQLeTru8cqihcO3XcQZwawvkEuQss8zmj66Y lOyVZmpA6liguZP1WuOez3eFh0aGVg9oHqeluhiKPESkcwOWR10XN7DIVjidCvcv ZhohRnMdRppmHhz+xw2dwoscwmVJYRbUVkE+uGVuDZnckjpsFE6HgAHJ2pxiJG9L JgHnLevPoRTwNP/M7r4MWRbl4w9UTBu3p0EMqY2s3OcVlGuW7q8/HLCZ06WvDh9G R5hEIUIFSY3Acs7XOJN4PgeTCSChrhaJI+WAzbbrTSvGljlgbJSdFUhyzz6YFW57 /8mgAea/92VtP+5hr135f4d+e50S8Fnl7jeOeKtZJ42peUKGNyEbvpYXL/1tNjCt d7wRJYpVLBPULgvCtqCwQ20ZnfpqYmGWuZusV2/5Z1dlHULtG7VAzvPUjdBFUhSp qZLEPS4Ixo4wTXk5PaZf0xYZtA5OggJnpx+c4GYDZtWPjnP8ZB4GTzOT6y4AYumM 37IkG2wE7FBo5MRN/1CAeMyMnAAPKgbxPuopCEqC9mBsplW4QP9bPYpp+xJZOPkR 6Fi4LiZEBdh4lwXiRQRECYZRe6/aU4H3+NpYUUVSfqyLel8nD5/mWTLPOrc2tasE 0B2ouSRzbtc2vCYnCCiLNzRa8DkO2g== ----------------------------------------------------------------------------------------- ###We took a huge archive of your data,if you don't pay us we will sell it or publish### !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6F35D78D75CB96A2

http://decryptor.cc/6F35D78D75CB96A2

Targets

    • Target

      b7cbe20ae32185b07bb63f96bacae27cdf68e8367a181174270165520a015d85

    • Size

      116KB

    • MD5

      da9941dae391e44a65f8df3653fea9f7

    • SHA1

      d356d6fb11ecb659d2bc2ad9f11ccf0601755dae

    • SHA256

      b7cbe20ae32185b07bb63f96bacae27cdf68e8367a181174270165520a015d85

    • SHA512

      485fe792d306ddd2c3362197c255ab8871184f211127b4b5482cb28fb94348c71382367b74a6f0bb9b3807a2f2f89401e7753eb87d543f821c80420ba919b238

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks