sodinokibi | 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

General

Target

srnmp.exe
Size

910KB
Sample

210504-kndam7njws
MD5

18786bfac1be0ddf23ff94c029ca4d63
SHA1

3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
SHA256

1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
SHA512

49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f

Score

10^/10

Malware Config

Extracted

Path

C:\688evawc-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 688evawc. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2E83B1D467D94560 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/2E83B1D467D94560 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WS0qspo6d11bGk5Uf7rFa2q1ZKh/cTSd033sYUrmxh1hQJRfYfYpN4r2nK2pMMIl YDEzGU9Mgy4C8cqrITcRGe7jT4GJFpYGci4Ww678q+AyiZO2jXiJsHtL+k5/EJ8r 1IsCEj8Cc6TwyJejQvHSdS+4sZ+MtiVFMxC//v/D7FHNwgSCqn6QEd8+B9YW7JO+ qxwL52Gj1H7WvKIceMnYKLt/I0PIVNjUZjC0soru+NcflCHzm4fArCa1dqoNDH9F rXysTS0MSblEQ7O1mFaKr4mFbSJs0x3FkfWwrDYdLXHZ/LQmEF2fw6RDKFUteK+a Uf6A+MIXACBJ/gqcZBBJXmYa3s/kfvihi76CNWCI6TDNOVwdyNeMrI2znFff+zBb 3+uNZkg5qWf1k6ybBWgtZ3JC5nvUwDxvrIdrTQtwW5VX6AtNxnSbu89XPTYgH/Gl 5eaheHWpnxTUuIHBIslRLaPW+SB72GiSePvovtCLK7f2ta3nYKfUg7bEBx1aVKvN Cn3yW7RxfkzCPKs7btn5clAqNvqizOKoz8E7pSxPsiM1y6YJdkQHQAkq41ScK7IN YW/7DLZPHaBpDt6eFZhVppAEOrZZUWnin6rUmtNpDPSxJ4d7HLwOz3Z03wcpvpDn 9sbYm3WPAnYHvVXUrQ6lw44EdRWvE6kF7BmY9+2y7Y0pXf7jOFV4x5icRrealFd1 Ay3JsKXNLfVf6484IJGd4OHRvssos58nCVG9SbUI2nYXN7IkKK8CUYzCZUne6XDw kFAM/BWKggj5/AfW3sp7qGGuoDi1PVB8HrfDZ7+jqD8K461OljfAWD6uHJBE8fkH WhUe3V/NhjGoSzIfcaOrqUnVATNW5vUMJVHWTSQ9c00WQ0wbMUWAOSCcRqBlDLJL lZajfiqHADVw1bGTgb0gRfJBg3+L2VBqd9YOVCsMdt9UYd/fV9MdTWTgajmWiPx8 kibMDo+LSsV7kRuNz+d+iga4uPIHXpei3BAnKHYiFxRM3jQXPzC6mjrgI6PAB7W1 Lx9yg3PjL0bCRUc3mvouo6u71XTQbKAQMlF7ehLK9Glpfj3bdp2CQS8ZVANX7O9/ kU1p3p98ON7Oac8pj9Q2R25RgaukqEZWBhGPHMhX4ZbZMYIkuzqg5i/U0My/U2vj Qr7ZcKW5xzJGkQ4FS1WrkldYOqsgwjprl6WDWiwjD6tT4SINPsP5qXsRyT4RNcqD UG2F4iV1PlRhA1Li4a9ZiL87xAz22gQd37889bLdkqTu6L1OyiPAIAIm86Nii9FA c8qG2X+9vWD4Ww== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2E83B1D467D94560

http://decoder.re/2E83B1D467D94560

Targets

- Target
  
  srnmp.exe
- Size
  
  910KB
- MD5
  
  18786bfac1be0ddf23ff94c029ca4d63
- SHA1
  
  3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
- SHA256
  
  1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
- SHA512
  
  49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f
Score

10^/10

sodinokibi ransomware spyware stealer
- Sodin,Sodinokibi,REvil
  Ransomware with advanced anti-analysis and privilege escalation functionality.
  ransomware sodinokibi
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2