General
- Target 12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin
- Size 120KB
- Sample210323-wfpb8whegx
- SHA256 12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39
Malware Config
Extracted
-
sodinokibi
-
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
7178
-
kamahouse.net
-
bridgeloanslenders.com
-
abitur-undwieweiter.de
-
live-your-life.jp
-
xn--rumung-bua.online
-
anteniti.com
-
marcuswhitten.site
-
ostheimer.at
-
joseconstela.com
-
deepsouthclothingcompany.com
-
dr-seleznev.com
-
ecpmedia.vn
-
aunexis.ch
-
anthonystreetrimming.com
-
pocket-opera.de
-
mooreslawngarden.com
-
osterberg.fi
-
extraordinaryoutdoors.com
-
kamienny-dywan24.pl
-
fitovitaforum.com
-
net
false
-
pid
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
prc
avgadmsv
BackupUpdater
ocautoupds
synctime
thebat
excel
isqlplussvc
ccSetMgr
SPBBCSvc
Sage.NA.AT_AU.SysTray
lmibackupvssservice
CarboniteUI
powerpnt
BackupMaint
onenote
klnagent
sql
Rtvscan
xfssvccon
Smc
mspub
encsvc
LogmeInBackupService
kavfsscs
ccSvcHst
BackupExtender
NSCTOP
outlook
dbsnmp
mydesktopservice
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7178
-
svc
ssistelemetry
adsync
svc$
msseces
mbamservice
ssastelemetry
altaro
sbamsvc
ds_notifier
ntrtscan
ofcservice
code42service
macmnsvc
memtas
auservice
telemetryserver
tmccsf
psqlwge
sppsvc
viprepplsvc
azurea
ds_monitor
swi_filter
protectedstorage
mfemms
mfevtp
kaseyaagentendpoint
ltservice
dssvc
altiback
Extracted
-
C:\fzu9b6439-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension fzu9b6439. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3D417ED45AA7BC2A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/3D417ED45AA7BC2A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +4UyqKqnbYLkT2j9keAnI37Uy9h6yHhJRszTHxoRvKGv3QHgppigAUsXyh5woCgl Nln4eoui+7mo0VergxuNfQfC3MJBBim9x4Y+zCQ3ti7RBuXX01CF120A1Mgldf3S Gvk25f6fApqb7/FFJn1MYwmsMd+i33Dqo6XRC7uFOGk/HHcBzSwl/we1hzbnM1wy G91MGgY8UtIxDFGAHKPTi/3kv6YS9iog3pcuFVj/PiGL4HriLrnavvnZdBH6GsaX NLbEzFoYbvMj1GbCV7Q1e/7Kym6DzAR5MVc4PxbK4pJdWtcXWxCPD8uHcne94x2S PigQDY0TC2ESJtfU1e64g8mbTWtjNUSOJ6+mzcblGzBrAvuT9Ddp/J9Ctsymdw0e 1BWHGfWVA/EGUMnaTsXJdygJEE3ZbZxu2+PfX/wgIBmTb/LwZAQJdHEZdvsPs2Vd f4alLQybMKvXEKy4S6EQJXH0qbaJLFvNYdGvjFbBKV2gTqAn39yw4hwz0pDnYZgc dtvm1eATp7jya8ClrRmvKmiMkt6L4obqJbCkgMOpU4XT2/ulGiMNfNLheHij3Nia CkRjCuWirsaGGEB/OrG+2D4OOVaYxQBCrWs9wWc7GpBRhdmaJpWUH1qYNjPqYdNG yo3t+PVzJsn6vRFucdanG9QQDCdGvMI5FubLjKvXKFnijUR5D+PEED8eY9NhoGXZ Prt85EOXANmunJn0jgg7xtF+5CB0Ughn/kXH41MAQGLVOlOaWusz5AxuJm1fBk6r Zg7lD5NpKEaFEcJbFEuQixYYlPXIscyjb+B6sJ2wgJFNpF71px+VvHJ83lICv4fw LsPCwCwvjLQ6HaAdtC+0fZb8IU/J6sJ8DGk854VyOLPq4GZCyQpgmW5XevCEMLkl j2VJ44MrlZoyS2c4Kf/+95fmSsIotJPAPUYGsHfxTZFKSxV3mcMHeMR4DRgHb3QA +9UL66O6Hhg2w49Mi4s6bfllaeMVCPJdajT3lOtxgykZ7iFs4uBOVzdcl+cxRtW5 L0gjLlxELQu1HgHvNHFkJb0yiEpOuvtTOhe3lScrH9GST+Q9aqXE59VC5nx+oVVg QZb0QzjRfPRkJBaTnfOqCjtQgiUAvse9a3zLqOh5s96jCXP9HZkG/OcWO2ssUpkA Kl/txpish90K2/OGNGCLnIBplL9Mf5PNviKFhkfZXKkdCUkdOEYA+YHLtFWKv98N JCnoPVsxSIRVRnQz8F+I5s7Hs0gSQS8CpToBomC42cMQydOjCKpig0LO7sGMNuUn DytJAKVc7yBj7uAX0XcZkMdnY5HeStQ3Ga8pdQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3D417ED45AA7BC2A
-
http://decoder.re/3D417ED45AA7BC2A
Extracted
-
C:\vkyz4h-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vkyz4h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0EF5DF8065515373 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/0EF5DF8065515373 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wwKK1q1Z9Rc2VtFHechjaMWiGLmJPjt/vdOtIrJkxPLUEqfuVDCahIgKm38NIcuO ly/eSAW6NZJHoGIYfIUKrEepud+VMd1kW3PtaXvWEf0paSR2vFYyMN15gJkSc2b+ 79AyT6OSjCSYFR6XbTDCghfBNGVw30ANTVzfOAsPnZLR9fhbLEwBkz2i7nKgMqiC l9EDkle+Ekg6FIuvqwUXVhT95wncgZEyv0Pf7xZadkbjxME+xxrXyk/eOoCywEB/ LLFNBU3ImMP1LNkR9utVaQJGjab2IjWysjg6s9QKfmiuhiLGPIW51UZk1wwmAvJN s5WtqcAv955+FeSbS3QFNMcwYue26xl6vR/JMVQQ2/P2f9y0uBNkJB4AvJDkWyVO nlbJotO3Hfax2TAeWibWIfLQeOblETOqLkNVZxJPiqUbopvI4H8qPG0KhKVR3qJk UwQ03EruY2VYV91ypZe5v6qDnM/BN8AR7K059MXbfsYFC84oKryFoVHKkMv3US1m wDcNMOYuHgsFU2KMHwWQFnIF0sIrO4iGx2iQTsZ+dObaB3iJI7oHGgLu5DyVD5iW 6dlAyJxFGGJ3T6gxXZu7FaCm9uiJDKj+FtuZj+N+qUQ4jvMDCGNOm1HFhIrmFP1Q nixl1v/WKy2faiSa3SK5oi5LeiCfn2UEBMuAef3/noYU+kspeXuauq6BUpESUKAN 9/EaaDrl1MB37jF5hlJLWAxrrVWtAqL1WVLH+npF5d/eWeu+v/yAst9llML40RAN ZUo37e5sAcH0IMzw157169wy+dCTkaJ5/JuTHVKXAbzh0chtH6YIksl06ndoFHC6 Mm+0OWq0fBNVjYWWxlCAtAmSi1AH/AvdqHg8krVjmWem2zV+M+Cda2RAZJpIaTW3 H/kSwLqzE41y9n8NsgYINdZCgJl+iJTBEV7A75Aj0MA1EFt5BePQX817aUcZ1bdV SLPYACEzlcBgKNZHlv68oEEi3iQjUmE7NAE46KzAk+sbP2uXV96Exv2nuWEA7jZV 4LUPb7m3g95SCNRpBl+YML6IeB+ViLKLEgqIt1RxSKytGm0lNRal0wjzSL1Fb0ra tS2jS40Q6NbERKhoqx05BZlQaKxGpChKDcAUMqp70Eo48wna0UkHASZ6SDPjZ5eu CFUcXueUeJWUCHUQmEaXOYZWAsUf5IDNgLBWteO6fcAngDdFCBFUQyFkXGQcxHns ygQbUbw63nwgoramBR5sPKjqLd+gewhGgss+hFBtriXJOgirFJH7ymfPkwccAGPz AnDRrrxw ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0EF5DF8065515373
-
http://decoder.re/0EF5DF8065515373
Targets
-
- Target 12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39.bin
- Size 120KB
- SHA256 12d8bfa1aeb557c146b98f069f3456cc8392863a2f4ad938722cd7ca1a773b39
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry