Resubmissions

23-04-2021 13:55

210423-m31zr4wvn2 10

23-04-2021 13:43

210423-ej1p8y7brj 10

General

  • Target

    08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2.bin

  • Size

    121KB

  • Sample

    210423-m31zr4wvn2

  • MD5

    46a40ec6d39b7530830f3047cdebaa1b

  • SHA1

    a1540914b5ceb9e772ee5898e777f48e3cd57010

  • SHA256

    08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2

  • SHA512

    64d3bd219e939100612242a35d36db8636a18eb962ce174284359178b6abb29c957bb1a0083015b948ff17c30e01ddd46c12824a83d0698b03372effeae0aa12

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$k6iq18BR3UU7uFyc.Pgy0e8GklmvcWyoi09nqzJkgxZN1vNGskAtC

Campaign

7495

C2

the-virtualizer.com

aminaboutique247.com

thaysa.com

aunexis.ch

allentownpapershow.com

plotlinecreative.com

spinheal.ru

darrenkeslerministries.com

peterstrobos.com

sanyue119.com

extraordinaryoutdoors.com

airconditioning-waalwijk.nl

ledmes.ru

all-turtles.com

euro-trend.pl

ausbeverage.com.au

micro-automation.de

easytrans.com.au

sandd.nl

wien-mitte.co.at

Attributes
  • net

    false

  • pid

    $2a$12$k6iq18BR3UU7uFyc.Pgy0e8GklmvcWyoi09nqzJkgxZN1vNGskAtC

  • prc

    oracle

    onenote

    msaccess

    dbsnmp

    firefox

    ocssd

    excel

    wordpad

    isqlplussvc

    thebat

    dbeng50

    sql

    mspub

    visio

    steam

    outlook

    encsvc

    mydesktopservice

    powerpnt

    winword

    ocautoupds

    synctime

    agntsvc

    tbirdconfig

    thunderbird

    sqbcoreservice

    ocomm

    mydesktopqos

    infopath

    xfssvccon

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7495

  • svc

    mepocs

    memtas

    svc$

    sophos

    sql

    vss

    veeam

    backup

Extracted

Path

C:\zwp4vjh-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension zwp4vjh. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/39C4D898E44BC803 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/39C4D898E44BC803 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: w2BOzy4jKOK9NpCSX8UzrdfPDNbbbea6ogXcZFPm09rCaX92NswX1T2c7CL3Lnf0 y/AYBR71+OHtRnb68Wc5BH4PjxvKsxEbbk9xP/4qJg6JlGbXoOafPnOaD20rVEkA kXwFCDkRnKtIyO17FYcjwyt3DbYATt/Qb7HY/iDBxS8qKIyM6VXfx/3dUQYc+u0z 3x8OmRtfuovazyXUx2HNI3s9EZg+zz8UgDqusT1c6Yj0eL2/FmTkFHDkOzcGn8le 2JMPVBR52oNxznOh4sQMGTIbqRszXpD9rw8oeN0Re5IUsfPezZ5q4vi2OnLJCzaL 4UxLJnFP0/PXKGh0cI7oKvzv2tCZNhK3Pc72eOIhDNlVtgdCT5V1RDIs9+gmn7QI BfmCP8mkppsXr14FvKy0OTU5qyJBl18HAb2HRn4agK4DHIkH/V52vLPHVdvySWU+ S4BtR7nJSvhtH6ofN3p1/2AWNHzcBlihgQvSnuh0LQfV64SpBD8NNP7VgmfcJ6aq YExgIgVl4y2+ACejiA2kkTAN88zvyiaq+n6+7OudIJteallZP8L1WJpLUpsGnPAj AFawa0vmK6I6LCj+n+9ClrmTn0BGJ/KNcfQSADQ+b0VSKtGieUrjObWQ4gkh0MFf KaMDYQzsq5mSA51mBTNmUKt9fPJzQbms2AoQ/cWBPceSyWfgm+4pAH7f7W1fq5FG +SXvAJ5JC5M4B3LtKecy/qqPZc8I3ohosQ5RFEYm9TXrWfaBgVaskb916j9hCB5q aC2VgCB2EY/B7tOey2w43FhrHDz/gtG5zKDgL5BQpDT+HYZEfWxyiJGEcgaluol7 RgicIRddoYx6P2EDvk0zj4aXmQ2iTHL1ZOhkoG+Dz8R8nztNCIqLzC4vx0UCYAKn BykyTW/WDTkSU2NyB3FClSWrzcmcxa4PecKaFP6ZZQG8BZhPB8Pp9OMzYiIwULCW WBpYDwQJ4UhTNm/5sp7kbVub5C7zYaiJABjYaih7ozwkwIppA1oCYRYvolAsrr7K ay/L0+zuo1kiSJLdmO+aa5UafkM/IhVNk9JRh8gHErd6OJ2sJMmPn2S5k11JJ3b5 VCX8AaSekDIBymArldVYXf1OjVF58mU2p4bRm07UlVU9NEf5DUZryfdpFS9Yz6Sk KuNdvSedop8KRM4oU+ylf7v+UMhscjjI1rn423yiR2wV5MQYApo/2YN1fP/e6Z9Y ureoPp0WSasVZtUOeEPEz3JybcpFBAMndvtn1rbsgj6By5hfp+MaboQfpFnnqNZ3 nq6hUYhkYhU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/39C4D898E44BC803

http://decoder.re/39C4D898E44BC803

Extracted

Path

C:\hlrnk1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension hlrnk1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F283ABFDD1887F72 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/F283ABFDD1887F72 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Thw54Oo1QrpqbuJjSW5krXpM3bvrJQNO3oo9+JakPuI2XB7lEMsUl99KEow85Aiu zw6v2V6btFfibwoBHwFBfsEO0tzfP0gUPeJH9KVrlMgn3D+xwnaHGNgZ1EUuIPIj KcZ7qrF271BnNLJYkg59KXpJTfvyPedKaUJVxYB7rIlMCBPC8cSYK2PcyRzFaH+y vQMUCXiIVnXm/CjYBgXJe7QBgsv+t/TaRgPW+MkVhoL+PTp1MkulgTnLkK4U9WSO 4S2DRQSZRse6ToGXB+HhngEoIUxdqXYxEOfpKFMwYo1BS2nvwZMmllyWUzSE0Kfz xEThQlZe8gHhk8YGuimhv+tUj0JOjput5LtkAvoG6oOkrrkHlwUSLzTppOOc8eBK iohErehzZDESyb5Xf3fwTQ4sMj8d0GwplhdhelGG2uE9J7jkPqioew6LGOxeWn/7 oiicI+78A6fVhfyfWbfhKS3lZMAdiqdFUP6YOWj/JuL/Myi56B5SzbOZWjC+Lmlk W12HkEhB0wcujTvOEtqEaLS6HpSiGiTfxWAoj+V4qtTgQkm1j9j4jroCvEdX76Nu z5gJGhKVRVOiycYfn5vxkB3pqCjx38n+iBWYjEVKXY97bPsd9IIFthpjBEzc3mHH IzdeqaY2oBB+uTiNFB2wb5AoMRoEXOQiwZcItlB9kWfhfqBqoeIxpV43mMlqQ12J voioDGR7eCbeOZWZmO+v8MB4gm7yb4mQGx6EadtVDLOvQHQC/eFyQ0XFY7NRV4gm H10BjUSuCCMunZD+a+vaUhsOch7aZcK4Kx59UEJUa6ISf9N9orTeQ7ideDv8UK0g iioV0chOSS8WnCq178r+x9lQB7NRk7C6Laxu3YPvkncJXqVBA9ywOSAgohfeAd2i 2lyUuuTYeA/1UgY6VuPhmBg/oAITgDWshYXNJXXMh+y9Pt840vYrfMahEV6rvrQg djmaWmpu6ITdXp0mShY73dai2uKMtetKPQep+bnAD5GLCiKp/BG0WkDqyr3LpYK/ fAnTSPqSyHzV/lZIKYc6wI06lgWUNEWgA+kvs0s/sC7x/+A3t0Ct73Z3laBtMCTj khi7US+Gf7+dJmzvMryExOpLaf6jRclGvWl2m0aUvZuAmk2Mb+G5de6iJ+ppv4X3 wCN0nyjpbPACuEAG7PxrYXoX+ozS9JZq1RPyThMqhLI1PVF0F75EGVnVoUlrvWcF agq6vzXuqDxHhW5PlEmzcjpt1GtLsMuAJbzp/DCmpC9vReaBvhEVitNjVoL/htEj pcj2FWCr ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F283ABFDD1887F72

http://decoder.re/F283ABFDD1887F72

Extracted

Path

C:\4j2z07mltq-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4j2z07mltq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F42768E394EB214D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/F42768E394EB214D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3Xwpz33dSGghLwbI0ZSWMvWTTm2eYlFQzjGbEvxYa4JX9KKv0ChrnBFWEVpAV2+h pGwfvwo6wwF5ov2i+3rhOE7mPa5EeJ7NFDpbCwhjBJMooYmcgXA4TbIWGn5q0gLy Du4FbpI0I4FZs0XbrTxyKMZOTm9Hb1hccyx3tykpu4MEWWQsT0OHMkxBh895yyM8 Ee2ozEiSu0tWwjdIl5onX0rrLz7V0GDo/U98FNvDRjx9bcgCrh+kR3arXo1fyyG8 h87J/uI98mqpFKb8hiAadSXpGzBhd5E76udeM35oknd5baPPjtn4ZYmXJvHdTbVu 4ddV+8BzJn/0z2XL6V0qKZnCcy3bC70j6XRiXP1z0NYwbpnqdYRNQaoyRnjMKmV+ Flr+j5Nq/qciMN+jVSFzrZ7mgaFqlbedjtAQZzwtlvxujPFECF6LKAn5FiNUeuZ4 h1MAciNfitxmQq+I0w5njbQQbfndES1Q8JBwfyPIlgtpfecZcAvIXVqGh+gVORji q3eEpjOQ6eNgzhOJuEIULGkxydMU0o2h7LKVJj4A4sPwqW97rpaFGI3QpiuBZrMD mS4GLfS3TT16t+IVHhMJapqAD/XRnm2HK8S1h5/W/q+xFIKPuLIOroSqfmVfADQN 9g00LFMutq4KYSOCCfpjv5P+MOTlVDqKoZbZC22lY71KlWxtV6JRuJ1r86aOudTu lrObQ2nNSkfdBfcquFeOI8oDSA58xx7LRR69S/iFek8gAGlAu6qYlJoaza700hj+ Qbw2BnQAvfd4r9lUxSm5QCnWtE+rTavPvhnU/kwDKbcFXGz0qzCkWYISGpITB0Xq 9HXk56VyF9rpBDaWlO9iGIbZFrGyGYepexW/MQOdhWtg1wQU0VmqRL2224KG8vgJ Tl1lNeSJ15uuuciJYN8mFgP9Wj8R9FobuFNrPSvo/MX5HEuuuQS/roSlDj2FdlDG UzRLtWCJ+UfWXthJuwOqOoX9FbrAhDZBeMYK+brOH3EYKI/1XietOALNEsS89COE Oj4VlO4//8e7w00EhlULAQ0EzBt12iTo6HIBqHQK6T9Y41v5i56LIvNUVB6+ipjS Z4bqCIe21EPpsh9P7Jk1jh54L2T6Qz1yF/+lhhJHmbnJQFbHw9C/3h4LWbPVhiHW ey5hTxYM4BKooaD/MwVY/DrhdOfNVzaTsGHwLi4rsF6HrzQXl3GJJ1HSgqgkkkcY kVX7SBfkcULH36dLoNcnga+z0xVB909PmpDYjxx5hIGIRCTubhatcHYTdOnleYvV EwTRsQvfYL0t1emwd98= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F42768E394EB214D

http://decoder.re/F42768E394EB214D

Extracted

Path

C:\w7fufii-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension w7fufii. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6DC7617B7BD7A113 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/6DC7617B7BD7A113 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: qfV4byQVl/mCmlyfUaIB02EWnZKvBvYG7lyNWD9LacfZsHzFJjG62d36J8Tal0un z0butB7tPAmg6kUyvMoBtTzXr8dgLxWgH+ocVEGQjTb4wGA04xo29o4iu0UYVYFq dO0SEOvEcqx7xwPAY+IGqeuFXieP0QQxcbKDMosndv7BBclZER2LnRjVm/IRrtOB tJ7/cM1HnpulALL8fAFvDMRFsQJ2tCNpQoxWZa1keOv+P1PnHX6EZ7iMRmTMcMqy mJfFYr00PKXbIPgQ2JUdMmDwLAQWRBMSIEGE2rJkI101COqzNYvg9tLw19AocW7o IzNiKxDzUj0jrBJqtVb4UFmAzvJFZUwFkN9Gl8EfYHAlWsjL8SAFGRsS64HiOsFY XcTobjq+I88IhKFqtKyyq9CF7bTuRnbeF/6nkXUKrgHOjeBROIeKyi8unpR0TA0Y +yo3hTWjjV8epCCeqSnjSKh1Ig5r0jmoPC1JeZcqmDecd5iQdTRjfnGhnd4Co0Kg TtuVvQsNDXkQI9E8Mozt0/Z2KnNiEj03i7j41UyEVC1bDCCRl+OBMiH004OAlS9y WqlCEo+SCNkG/2FNeqaXxqfP6zI32hNIMXabOCfx9mBn5ZAToQ7SufTKyn5z0Ggg blfRBqdJcHrSfMWSDedPJzQXJ4wm0STQ44DCGgLhSDnCqX6GoApqZpGkK4HTeFuZ yT2TcD9oFXpvFE9d/i+9xPeuheRz7eaDSjnT7dbPIr4I54Kym8LBr73gNxTf5Ab4 lSFJFspEJ6yOC+i4d1O07keRabNJXucRIXNYLjooQp4SgZkXLceQTOkd+ZtZDTeS eo0YdfIv89yZk5FkZi21k8rk3+IbtUkpFUHqbQ1QBuGk0j0BdU2IDLyqHjJUmcZY fh788T6yHTCzAwOouX8Xr9Dtmsi8n+rAWm2NCLgPpdnpJLZHA/XlXCEANO5ebI+W ogvuHip+q3AxgMsaj7dmGXd53PD8oNj3G2MPK585rhGlbC/ofpzqjP+g7FXhEY7J 8BxOiv+S/eoVT0AfyqahbmDt4evhMY+e9QuTxXjmPSrXJ4ttKgZNFpFURWpsQg+8 e+dymf3pMzXt/yeEoFo6q/xfYjDztV1O4AdgLlLkrW8zwON4uIelb2E2Fo7rwPw7 v7dbrkpuNHybY+Z6EHBU8LzxNuMfwzXXuNGDVDFjl+15ZhDrL5RInDbjX3O23t5R uRouAYBXsa5L8u5dIBahnQvpfWA/f8zF6Ak7Ea7U1PuUpYwri5NAp2v6mKSyMgy4 8XveLdkfJwM= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6DC7617B7BD7A113

http://decoder.re/6DC7617B7BD7A113

Extracted

Path

C:\6p45b41o-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6p45b41o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0B5F0B3E6148E7FD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/0B5F0B3E6148E7FD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cLd2PpHY9bMFp8PBnQtIxiUgjvWRpG3EzzNvOLN3qdF16YOOxs1l7VgZICA78oCK v61JwANWIM7om84jJAkr24WjMvllVytQKBE7z9mcvD2K038w8fwyWIFN0YGmm6PR A1gFRWq9AfpAYxvYwLiSQF2WiWhiYTCk0csj0jfLvrYN4LeBMASTYqEJsVu2up7A QCRWblnElgAS6+qrw5jsjnmBdW6ip9DaELZoMoP/dKxubQZyRVmxlGuc2b2JiXbv f+D1YJH6XBKjiuYC4zvNiqKzxiQVbkGbCu6IVKIFXh8heieuY0gm+pkrP7Au3ujN Jkd1Et+955d4Dj1VH06SBkWLD4gZqLqVPKMvVe1TPRPJOZL2sgXbFNzf3e/tJHQq iO9CDSvy/Fhpw6JPQXGvQ5rdTIz9gElmf8/lrP2tm2iJuyNG8kmmHh29Dn+qFBLY pKy5v+KinwDtLCoQRP2hiCZXFjiE2RD5Td5eyLLpTqOhkTdHMC8QHakq5SicjZDK JKsuMuRYVRiO24ogJOL3djraB6+AkKg+6zPeUN6I9K0JopZ4mCI0fL5eY0tj3CFn 4TkCNaXn6r4GUMyjdgwnQUFzULObuQ8h+6DRw7VxdbT9SIo5TB4SaW5qWgdm/y3z u2PmiFvze+s2gcOAMnBX3mJDTSqVZWiIMIERR6eDwq6sdVH8K8SvuaTx9Gqyg/G0 jceeSUb0P/WT8he5t/ipqSnkZPofPXmmEYow7Vt5MtPluNF27kj0XC37LbxLDSOW Cay77v//dgE1oTwcXuE+W61LJCvyHs3Vn1UsDSZz97/fuw0xk5PMT9wOuRkrUgrW KJV+ZgMGJsBNtrOZbRckZJ7ZPmoMTFsnivgAVpNQK6ChAPo54PJp1PweUPaai6t0 WxXrZhN2lkwV3dOGIY5t81zEso9PsVVwzGq2Nd5K+5dBji0PARpV7XPAx2hyZCuM 77gXmkWaeKEVzmKOFG0zF196/+q/opQU1VGww2WE7J25NRBuoJApgepcVSp+dz05 2wftv63R1a8n2K3TpV3O1BAe7QusXDUG7PZaPDMWlT2GiDV5GwiWkXFXM8dUHfQy c7ipOJmxfuHlS/gJji1+ypsG/rRnfW0KSUd3KowuefBPe/LJymGJUy3WGLEPRUul yjdRKPcclVhAmTBnrAsimM9e8WKWsRHH1NhTTu7qgVlViyk/nq2aAADrNsfuQhld k4W7PpLoRcHkVY9wZJPWDSWHDb2cuKCGYB9ekj5MKpXw2n1IwDWrRGVurV8d6LFT 5WacDcpR1TuWsKutTj3vkPaUfF431KUChBs= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0B5F0B3E6148E7FD

http://decoder.re/0B5F0B3E6148E7FD

Targets

    • Target

      08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2.bin

    • Size

      121KB

    • MD5

      46a40ec6d39b7530830f3047cdebaa1b

    • SHA1

      a1540914b5ceb9e772ee5898e777f48e3cd57010

    • SHA256

      08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2

    • SHA512

      64d3bd219e939100612242a35d36db8636a18eb962ce174284359178b6abb29c957bb1a0083015b948ff17c30e01ddd46c12824a83d0698b03372effeae0aa12

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks