General

  • Target

    8hHzXixt.exe

  • Size

    116KB

  • Sample

    201103-w5xchsmh96

  • MD5

    73f8252eea3a1361eb07f58f7e695f5d

  • SHA1

    cf153e39e65b2ccc3ea0bc7637ff075b9f43579c

  • SHA256

    e3e37c5cf4b43ea92fd71e08edc38bcfe6fe33f283f62aa5632113c444a71b00

  • SHA512

    ad9f41b212568ad5888641104fdb2ff83fb98d97ddc8728ace4d853dac14467dd12b6162d0df43b30f54bfc0228c193fe7dec29ebf83392a7ed96a938d3cec86

Malware Config

Extracted

Path

C:\993zajv3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your network was ATTACKED, your computers and servers were LOCKED, all files on your system has extension 993zajv3. Your private data was DOWNLOADED. [+] What does it mean? [+] It means that soon mass media, your partners and clients WILL KNOW about your PROBLEM. [+] How it can be avoided? [+] In order to avoid this issue, you are to COME IN TOUCH WITH US no later than within 3 DAYS and conclude the data recovery and breach fixing AGREEMENT. [+] What if I do not contact you in 3 days? [+] If you do not contact us in the next 3 DAYS we will begin DATA publication. [+] I can handle it by myself [+] It is your RIGHT, but in this case all your data will be published for public USAGE. [+] I do not fear your threats! [+] That is not the threat, but the algorithm of our actions. If you have hundreds of millions of UNWANTED dollars, there is nothing to FEAR for you. That is the EXACT AMOUNT of money you will spend for recovery and payouts because of PUBLICATION. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/80738617A6B16F69 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/80738617A6B16F69 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MgK0P5BULDcn6fvLz/LxNYLnIgqVqTy3Rk7RUinNRkvD6IpX8PgkTzQ93t8wvhtc OCW6Yr3zIQOrDcn2PExNFuuJC6QFd1WIlp51dUS6X/4jBeNct4tQhFHenhUpw0oX 47+gJ4a6EP/GSXc/u7VT7/8wKV/OXg+hqDqmSAxcbQiOYRmtlETZ+m6Z1xS6kOo/ VIGaOSwzoE54Jzb+caUtkL+6pm5XAN3RrySBk5tZYuRH1mp2KF4jq4PMIGgluife 4CF3Jcdw6LYdyQQ3U/FXFuz7gnMGBCkR3KDlIBuTTrZUvpUGW4aPix2U1GuGdFF3 dJEbKhzNrg1f+KOJFu/pBY66l/wiIS7L5W4Y159NYbTF3CKTb0OPtZn5DSMybf/2 pJogkEOAVARuSAbZPWqvtwdAhNNodvzxEeF5nmvRWP+XsXBKRA4H/AZ2F6m+tIMs zav52gIlSasdMjdfomflJzHK52qJ9PrmpK5/9KPlrqIatTocELhwJJlkK0faesy7 BW4MO/RkZECKAiKKqWBzj/8yzmx6xRGfbLniJWq4B9ie8AzHIsMVDOf6+qsGeTnu jgyeLNE+lOfWjdMZUyjlzlPEDZG5o7piNV0Ds/EdkSDG5k69iDbz93E5Xua2XMqp sSLKOnlcWjvHwzSeV5IZceLGVCpAETXqOqz+htrYdAKRZQHeq1HyfM9sbWnCFzEG gUR8PpBpuvKJhvCVIw4r0euzAeeYm96Z3zl47PnvEgbUA/C8aDpCHzz0dT+kwudT Bz/MO7fjhITyxX8KskBdcCwrtphYuS9FXSCRcSpnVw+Z2L7aFNjdRO0EritcEuYJ Il/vx+NZZRbRHYSuFpDwTGBwCYv13P6MAolL8JXTf5Pmj19L8hmp5eFV6ZRwg3wx v/Q1S1tACUr+2qi96hu93QIx+JqH3qv7D7TKCzG/QT2R1RLa5TZu8gH8m+ZkzJMm J7JxGwtQZLlpjIicUSKdIeryB9AmUY2HgItoVNNdToQtrsZ5ZT36p9NX9oP8+X7F UG4027wTy3GrwlRrcmwO6zSa2P9m7xaQTFWDbvaEajmkBogZEIlLMyYS04KOkB7I H5JT69eKTXkXQL4sMY3E3QC5n1E/SmrRg2rm1S95Kys5APPJ/YWVLqgwfMsGeLhU dG1bXc3fdvqHwIGDSU2hP0QeXN/ODNWQuTrxTl/+2hQxR8kuEA4txH9/CF/zrwUl kiqN/zOl9n34CYlgcRr2YKs7OMAGFYl7d1E9Qz8YIvilvsJAQkcHZpnRjEk1bAZe ziw6OChYwDjh6BOcaY7NdAYJh2U= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/80738617A6B16F69

http://decryptor.cc/80738617A6B16F69

Targets

    • Target

      8hHzXixt.exe

    • Size

      116KB

    • MD5

      73f8252eea3a1361eb07f58f7e695f5d

    • SHA1

      cf153e39e65b2ccc3ea0bc7637ff075b9f43579c

    • SHA256

      e3e37c5cf4b43ea92fd71e08edc38bcfe6fe33f283f62aa5632113c444a71b00

    • SHA512

      ad9f41b212568ad5888641104fdb2ff83fb98d97ddc8728ace4d853dac14467dd12b6162d0df43b30f54bfc0228c193fe7dec29ebf83392a7ed96a938d3cec86

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks