General

  • Target

    b69a30084b2fa7aea309e867e673e3dc5caaaeed119f5c51b271e3144b634309

  • Size

    115KB

  • Sample

    210226-fxgzgzg86x

  • MD5

    d7dd35bfb368ebaf9b42d2824ae8d940

  • SHA1

    99f3dd3376e9615f5863808ec4ed051ddad7ccfa

  • SHA256

    b69a30084b2fa7aea309e867e673e3dc5caaaeed119f5c51b271e3144b634309

  • SHA512

    bbb79586ea55b31bb45bcc0ced9c1c8aa0cb2cbe8cfe2d084242b948e04a095c5b3880d7ab6e53eb196439f698ebb955d9c6e882508edf5dfcf2849d4b8615fa

Score
10/10

Malware Config

Extracted

Path

C:\86z806-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 86z806. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CD0A183B50D548BE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CD0A183B50D548BE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: y0JGvme4FFcrZPxBbBpPKKZWOD3fh2ndOTxSHc0tJ90uv+qSMVcqmYfVpd15cF2N aJeznxjeTG3kXKQn4UjOF5V9sdBKaIRtX2+0izUJljKacIvXMBFkBd/pKWLxX8vS 9aoBwZZYOqKjvPgunEK7xyHob26GU67zFNN3q9mno4/8WsPqAFJ8IwocYkOYkHDH HDxO7ENce6SSSTIjXzynHTzumVRtxB2DsrU4+5/XQGL+3xy7rmjx6g3xl0VRhd5X H28vsG/ixdFXMYaYKBPogDU4gfiy+rzQh60VQdBkD4PHvTiCqEdHi9ifTrf5DZUK l0R/eghekjmfEuKscH/IkVXCH1WYLSl+3/U+NZzKxq2QLWObam49ax7T5j7PBm0p X62fBoURFMZ+0v7DDxfTKyziGboCJjnOTPMNrIxOoe/95hfh9lSKINqeETFB/zCU NKfg0nY+nZiQdR0sb3FI6EIvaayWlv6016ZraruYEG8RDPMeHv7s1CUESzzq+hfj qhiEfl2ZVWf60aicEbddmVhL7kjlF6Pf1a+60sqpkGcqox663s4csHDK34ZKFN65 FFjTy2HVGIMoO8xJFRsyJZ0jFrJWR++bfNrPR/EnT8RakJNX2WD+2Dff2xdkiJiL fopggXherEwsRTARTrSdnoXKUlwqZhyKJZMf6U2ust+Sjm4+DubuMa9C8UjZ4rlw aqhFBV2xy+fakTH4o+XrhTWHCYQL9xk1QHTKCYcngYyF2uu/3a57ynkQI7dbS3V/ P8gT4WnMlbTXE53N32aaR+jcta7rUaHU95KsgkFvMpUW1wO1fYhhozbzIBZBa7RN Ey5wb04gygNM1sQqkeywfbgmcKlltPizvis4N4Azb0O/0+c3vtRI9r+bI8i+k2ld vyJnNiBW0x05wJFB9umzOZq6JaC7B7iqsn7Ckd9t/P6YTz4SHvI0lgYEAGGAlDGX vySPG+uOgpIfxX92UmzIxlumSD6zVPzCrQ74iklll8SbO/aTWfTfjtGgqP6EICap AHEBL15ynHwEpu3o4Oy0GZXQTmeg6hwFCYfSrJywUAr81o1YB0Us8z3LfmMIBPpX 6T+5Dsrrsn6eD8gig2Otif7Snwq/aQw7WK3hfTEbwyPDH9J+J8ByTX1BVQMxVk52 IX3fniRJDlf1UrR4KVnEI4S+MgTWiFH2y8f9wz57kVcgOWW6M3W7GB1U1JSwCpI0 jHCZcg3FuLXr3LGjLgWTsY4mDolGmzwLBmaw+9VJVLnYvg18wg2DCaRmVjiPawqf QKEg3grno1sZTdB75Ag= Extension name: 86z806 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CD0A183B50D548BE

http://decryptor.cc/CD0A183B50D548BE

Targets

    • Target

      b69a30084b2fa7aea309e867e673e3dc5caaaeed119f5c51b271e3144b634309

    • Size

      115KB

    • MD5

      d7dd35bfb368ebaf9b42d2824ae8d940

    • SHA1

      99f3dd3376e9615f5863808ec4ed051ddad7ccfa

    • SHA256

      b69a30084b2fa7aea309e867e673e3dc5caaaeed119f5c51b271e3144b634309

    • SHA512

      bbb79586ea55b31bb45bcc0ced9c1c8aa0cb2cbe8cfe2d084242b948e04a095c5b3880d7ab6e53eb196439f698ebb955d9c6e882508edf5dfcf2849d4b8615fa

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks