General

  • Target

    68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9

  • Size

    119KB

  • Sample

    210319-yyejrhc43a

  • MD5

    4f58e4373dd886d6da4268349437e890

  • SHA1

    f3b8809bcc84051f1993b7d3f087a5dbf799e913

  • SHA256

    68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9

  • SHA512

    4e88e24bdefc2e21cf86a7fb12ebb744cb04c8e43c997438c176126c651d1a3aa254e3b47156cbc8f6f8fb8e69be6613b1d07411ad0cb5f37aa1a296bb8f6533

Score
10/10

Malware Config

Extracted

Path

C:\6dp1ck6tn-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6dp1ck6tn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D0F63F820A458B4E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/D0F63F820A458B4E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: pO03s8ZSa18RBsPJPigXoJAwDdGVLwFDQuO3OJrIroEIR38iEulo/vqbTXktx1VM Q7JtxmsjY5S3CnF/gfIvqnCCKZdXcLLu40npbm+JvAs5d55Mu3qULNYhI4kLhkNj gH7tYkTY6ZulmEk6boskrPH0FNqK5aVqTXo0Pa/pJO3D9IKD046pIq1Gqv9AAlPy ykJJD+3vs9BBvrv6rd/gLudZHHnQ5N3ez2rM1+xEhWG/Fz9upi2EVL0eJnYRwT+O 9jbQ9LeHi6EpcjaCmcS+9xUk1X36U6dsrWPt1h7UGtYc+O1cbsYU5KL+GMbRBjIL sYAFdz8GYiaP/sLoWjY1yyXN5w71Rg1Yh++WW9tXsHeyRVBhp4JiAeGL2r9F8vuG 1qZB2MxoN9ySn5vCuE0Fvly/a3JLmHumaYAQJmV2ODnHYVUUu5xX8fdUUnuq2XTH mV2ihTpFpmwdQI4qP4t6RDkM+qxLm3+ZEP6vwey1hffmbzSCooK85FSU8Oiustxq JoWDDT6zIkkmkwvFzEy8vTvqsPl0b3y5SHByKFSI/w6HOrv5gpTrbOAErL4wyw0N Nvk7pXu9GdAUPaSJur/GhmPdXJ1+u5ru0+wb/ulgVLLE/nZ6vGPrtysf+uAkBrF3 2+7E0+RYnx3G3y4i6ZQER+Hpg15uiONJEFV0dXCzmMAevxLVWHQIEh3TJi7Fpsvr /hI7YU420B2+NMmYlaaA+piwAZ0GhW9SnGZarH//q6bc5iYCedjGbrnPQpK22JNI e/Zfy9SkmjuTC4QYBD4O48xp22wLU/RTM8fWdaz/AnUHQ5QdjcuHO/Rg1q364+a5 eFkoF7W0IJJ5sPnqCacuUrXWbb3dKojGzkJebdykfZf0hdagBuoWeQV9q66TfQGK x4YENPaNHOny1Plzu/g7zv1xVS15IdzKH/Ezgk3MsQW6UwdHTkdDWeUuCxguXoUT TvF4gyDKjE/YU1NilsCjq2BMDRHBAb0GvQlxi5BlQUbDJ1/Mvi7UsLcikSTjBHmb hY0G7ZH7zKNJBtkvrZx+XVY4aGuCKIkIwjsxfZpqpalyl92NVLbb2FO4HZgGMAdY +fyjjWdoThGtjXZ2166VBi3HmGlhuU/PWFe7emNRpwxJfRVhHQit0KO741o8dY3U V3Boc0S0kgJnqP8IgwjYTZECGZdm/pF74+LTbPvYwlHA+k9dXlZ+WPuUjdhgYch3 S36wosI2zJqMHlFVAt0bKzfqhSUYrcZEc58TnZz4c7Ev4P6ggDWXb8Hg8e7Ev7S+ N+nbpRisTuAojFoh ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D0F63F820A458B4E

http://decoder.re/D0F63F820A458B4E

Targets

    • Target

      68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9

    • Size

      119KB

    • MD5

      4f58e4373dd886d6da4268349437e890

    • SHA1

      f3b8809bcc84051f1993b7d3f087a5dbf799e913

    • SHA256

      68ca9793d2249248669a6e637ebd25ab3d6accda4da0727112496fa1c5bc8af9

    • SHA512

      4e88e24bdefc2e21cf86a7fb12ebb744cb04c8e43c997438c176126c651d1a3aa254e3b47156cbc8f6f8fb8e69be6613b1d07411ad0cb5f37aa1a296bb8f6533

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks