General

  • Target

    ef97612bb189177026481938c1e40e80a61bf504f7e491367b206b9f87700d88

  • Size

    339KB

  • Sample

    201021-sw1w7nm8v6

  • MD5

    a976d4247a7f411914a8d9caaa8efc09

  • SHA1

    ed7e0f161617547b89e41653c671b475cf6a4dd9

  • SHA256

    ef97612bb189177026481938c1e40e80a61bf504f7e491367b206b9f87700d88

  • SHA512

    4abe367dfe139c429d4fb71f58c4ba72a6fd9f9906475a1d43c0971a1fa054de332a7854c3e3d3de22032c5838450618173be2cb0553bb5efdf21eea209d849a

Malware Config

Extracted

Path

C:\001715yzkz-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 001715yzkz. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DFF35A85FE3383AA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DFF35A85FE3383AA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: VDeJYSC9807zP7R61UHMCROJdFs3qIyqYMtPu/D5+N1xo3zNYak+qoZ/fWRsVK3m uwXa4d+4RUAPP840ZBFTI/wVsFyumxtIOQ+ikQUDqmXd7unDuwGI3QFPdJXKvq4B OuzPoc85YvCMlK7lt6IFx3beZX1XVoenfsQmWFqvy+kDQ3fK3TCt20B77zOLoVr/ VDh0MjTX54Xzan++5eQCE3OLb2JPpMMjxu5oivP6Z3BpQAR6X4wX63mQmCkqsvY1 T9sTeW4ZQgaaW1otrYLsxuGu2MMFib7qiRJ4KYPiBb+tlrdqnHmqRWemxlu05V9R EYgoJk8UH/M6LNRio567Hk5YWfAIruET/kDcwG9OV25X67O3SeRsgpFAKKPb156g y3EFLrL8Fs8kaEt10rzG01NM916L30Xc5AWW37/cxO7u7Z9BmGLzt11T7e82IdGs BU3XpWvxeC+8H4CRrgn6JTYYSU+dnmWYakwLNEZPZ5UeeyeEgIEzF2kGCZ5JRrm7 f/fDHjlZdot+SV1aJ5Ot6/lLcPvNbl0Ew8fzLvdIi3LlA78l3T8dLrAEFIDxumaO zDjKh8Sfhx0nidFwb5MQaYAoej4rSTETiNTinchvH1gXEd1Vr8/ZOJfX2MAfgocE 6iWcUz8cMf5iVwScFo+C9BS1CI2QCDDO4gxoIgrjpQZKa2k5id0C/R23I8h3X7SF 8k03beR3ACihICdFRjD+CcuQ2vc2EejNqHgWjXYd26qtd3ynv8AzcJDNnX/ZaHaI TDFxz8pizQSSaAidy1aY9NSADLum4tgjgWzLfxmC90OGtncJHBodiz30/Cn1P5m/ qiL8ZPIwrode8KP0i2LZpQ2IrJfbWfF5hKPBuIsvFJDivz+89q0lDcGjNcE4wYWY EdHOhe2AIBC4oYPZXVAejhQelpY0TTPAraGESALpzsPX+06UdmsJ5s4F9QDGKUoy tSS7kp1Go4zdRnJDzLDqD4FLqcJooWTSAqdXOORAjkBwoL3sH+ZNh6A2wSXcFWtI yW5laDiAcDGLZKfKyFHDOnZmTtCK7FozAf5GZkf0NQzp3ATIiJiDTNqgDfuDTI6K R/BRcZW06AbbR+1B5F+LdFcP4u6P5QXZhtej2scTKy7l1e9dsfWSu0Spxlncb9+C JEqiLXTs1hnCmXgqG+BG1gfk9x+FmK06reAuylHVtFshQS47Hg2W4EB/rnUHlv4v 2xBGU+ek7NQajhI57M6K6Uuhw78d4P9XXm4AoWrapLjlkINphvoXQ22mVw9eDra7 +xV2O/5f31ECWJrgab8yx25Xzkrunzto ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DFF35A85FE3383AA

http://decryptor.cc/DFF35A85FE3383AA

Targets

    • Target

      ef97612bb189177026481938c1e40e80a61bf504f7e491367b206b9f87700d88

    • Size

      339KB

    • MD5

      a976d4247a7f411914a8d9caaa8efc09

    • SHA1

      ed7e0f161617547b89e41653c671b475cf6a4dd9

    • SHA256

      ef97612bb189177026481938c1e40e80a61bf504f7e491367b206b9f87700d88

    • SHA512

      4abe367dfe139c429d4fb71f58c4ba72a6fd9f9906475a1d43c0971a1fa054de332a7854c3e3d3de22032c5838450618173be2cb0553bb5efdf21eea209d849a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks