General

  • Target

    f4f73a451c1ec493eb3b4395d06de73598fcf5b8f7d13e81418238824d90fda3.bin

  • Size

    118KB

  • Sample

    210207-9qpn5zj3x6

  • MD5

    8a6c49fe4ea20484411093997d7ebf19

  • SHA1

    05cf02f7f79f4dda97ffdc60da9171ec0699bc68

  • SHA256

    f4f73a451c1ec493eb3b4395d06de73598fcf5b8f7d13e81418238824d90fda3

  • SHA512

    6a8519cb92c1beade84792bd648d67ed2022b13099d663d066228114772c0797653053285d3c3a515050e9ff1e7561392628e7d21b8ed11bc734f7758a4d1d07

Malware Config

Extracted

Path

C:\s98g1x6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion s98g1x6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/80738617A6B16F69 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/80738617A6B16F69 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Kfal4TN0cJTg81eCgxBbfv7RCaYApopcGFom3g1cZ77HTtgHzyt4Sym/yVXkAaAj npvhzc9Up1Nku+wm/2df9z263LpOnuno7XDph4py3aesip59ODh8c8jIe2ADC85q pFrLfleyfV336Nw6vnQoPFbKG95DpB05OvphWaCFAJgDTZEuZ+sk48rDE9cf7V+Q O3jfN78b/AkU8mnEaSpT3SpGbj77a2hpTQD3PZVg67ICaNscl7RuAsVCgEtc1zdb a42qTnga45053YW4VMgLR89l10mrp5Dp0ItwSSJbjn/lPpwYfUt/cQWP5d1d086g MP+Nf3DgsOAvZD905zVDCk4uWtpEJZHX3M2kFT64/pDuD+mnPseGWvG8eusnC2Pt JO2E+fWgAQUs1uBGfb4d5I7dzq+lrffNTCi++M2JYjXBMEjpRe+JOyFn6YOGwz4/ 01zYb5Sxoiet4wUPlK1t2//LRzg4W+T6mUvAXgwuRLM13/dF4VW9h6P5RUnQAoi4 +pEop2gDVn1EsR0GTPQFNlE4lpV2+EmfpGWVUTq2Lh8iTZ0TVqGJ4uWMCe80FrNO 6Q8U2OTjj9iqfDv0lDtSArvuBMqhMsxBUVgvJ8OaEAYHVLVeNfPNqKNnRMRIurmI 2s9S3GBpSwIgT7vzKxT9mmbBWIyLKRUxWrb9h5liMhbaplUw8YLu4wRKQvoDmDV3 fq/KDVeFf+6H/EtnmQwWuptHQyLbFsJXThD54z+rA+SWU8SirjKHOAGus7EiUIEb ruOac6ygWAIcp587xfZgdyeIH4ucZHt+aNU9OP0tJ69261pYnVxW8ZpP1kv09HR/ +FMwGiAYH5aYHf6Zoq/AkU0c742jGhh88pGD0fCHGtAUROGcbwNwUmPKKnyD7HxN sDqqQ9SqqhJHlg3DvUjBDjMECdSRgCODkSTHAbJ8BS0Fnqeb15rTqLu06tV4Q5QB j0AS9LmdNaHNCls0q6y7Gn/1rTVeMNQQk0roEbRNdtRAFAS18t3W8C5fwe9KzsB3 iQOrKh9EOEF62Bkc/QJqxPleqhJGMBGlrgadvja7Fg7VXNEXIMdDASvRGKk02434 eXaC3gwNOmjInXU/08m7gvE94Q9SQzZ+VSsVSItTV5ZULyEUAqQCBC3/3s9BVGIS nGrqfPkheaelsbRNDjzMFRWJoGczSX2MiNlktPzxO4XGKSnJAklDjnASeqmn8z8e vmp3WE74JIcJCyz/7bpwBHBNbF8S2MVn52PzUXweIUTGa8MnP8OWRMelIba5VoHX fXTxYcsTOO4b9bLI/miRN6J+ Extension name: s98g1x6 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/80738617A6B16F69

http://decoder.re/80738617A6B16F69

Targets

    • Target

      f4f73a451c1ec493eb3b4395d06de73598fcf5b8f7d13e81418238824d90fda3.bin

    • Size

      118KB

    • MD5

      8a6c49fe4ea20484411093997d7ebf19

    • SHA1

      05cf02f7f79f4dda97ffdc60da9171ec0699bc68

    • SHA256

      f4f73a451c1ec493eb3b4395d06de73598fcf5b8f7d13e81418238824d90fda3

    • SHA512

      6a8519cb92c1beade84792bd648d67ed2022b13099d663d066228114772c0797653053285d3c3a515050e9ff1e7561392628e7d21b8ed11bc734f7758a4d1d07

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks