sodinokibi | 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

General

Target

1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.bin.sample
Size

910KB
Sample

210602-g7vewxk4c6
MD5

18786bfac1be0ddf23ff94c029ca4d63
SHA1

3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
SHA256

1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
SHA512

49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f

Score

10^/10

Malware Config

Extracted

Path

C:\xes7k9r4-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension xes7k9r4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/82ED7AC18EAD716D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/82ED7AC18EAD716D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xuazoaatCmNXegLdZgx030rTW+gl57lDhFcW89PeimbLMDLQPZBgfjjOrYUHdY0a 7aqVINslUMHlUCfjcBzExTEbAklHDHq7qO3Fwnzobz4wpVNSX4kpAFa7F8b54usI 34QPXQE1O2brCl+s0iCYdtSamarKyCiPsWnSyRv4zlxpI92IaWLrZqrIG8H3i7Ls /Vqjs9MUJxGvCh2cBcj+fAxHQrXcKfR+GPLRM1WR11v7wQEQQj6+S9iuhPnTEM98 GZS55IZAO+G9uWEkOqPaElloSacjia+CfSIch6mqoe4vZDnBGXihlWvy9k1KZHfN 6OquiOdyQ3Cmqbm3MVben9E+ZTxx/vbINpuCQsSIQksw0kK9dXjC0ZcgomLVuzpJ GPBcqGYt1GsQdj6w5sNq/Rp9cxbh5Q1nLSSbSOAXH0x6eDVKsyKL84LbeEZsH+jZ k83Pn3jTST41gJs3dpu86rf9rnI2gqsz3LSNBcvoqZcq/zrigzw9si1yzJlRg6c6 5n080zUZ4DNspwkXrbv5tOFFHvsRf4RddmHkKWOi8sO42rIonsl5OTT404h6CIlB WiGVQ8VfBFV/kfEgh2QYlw/YniAhvH83aXXuILBQujVoPR00T+xd8q945lyWH9kv V8G56QI4lYAj+mLflt5XZm80sxuB61AX8bLlMQI7778TVJMlnWZ6V2S1MsY2ltk4 CIrdbtFdf0LSv1y1MdRcbb9MIVSYZKWdhgBCzD6KLWM9Mjwae3C9kFOTOGeG5isw XHgRcgX7dcACNH9AEEqTy03DeGZyYr5vY+zbrHH3AHNVxffZeskT/zqFOVlIGW+A AlwskZKSZf8OItPrRRg3+xcDXXcAIbZDK79ecj4+Ca2swsm8zrJ1BTilaJRd4e1Y xu/g3PTV/k0jT8yA3/sULu14xWbWWz1cHSVXLLPFBet4WUN7wbE+qlvew53i6gs3 dKL1bLVhZN4lJ64mvR/1ZADRTg9rW+Z3vJBhbUt754YYTybppd+rx9JydU8YCCYe m1x9Gw2fBuPs/MAH8bBqIK22E0a94PZW/zgsI7eTLrqNWm1QoFP5V3ISB/3f2RWP J+Uku/dwpp6mk5jx6o8fZxT389KaRvbfBVJYgEXTXcplp1jHg2f5RxhT6D0BRFnK Kvnt6P6ZQ138rYvIAlzbWlLBuwomIstKeCR1YTSBcU+swYT1rBpXb1JvlDQrvz6T 7Ar20RWVdY+B3ppOYCu6Hw4Um1AZ60DYfmxvpaSOrMRPV7evjl+5GcyUBq/4MMTI Mlpp10kHH7E1EA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/82ED7AC18EAD716D

http://decoder.re/82ED7AC18EAD716D

Targets

- Target
  
  1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.bin.sample
- Size
  
  910KB
- MD5
  
  18786bfac1be0ddf23ff94c029ca4d63
- SHA1
  
  3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
- SHA256
  
  1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
- SHA512
  
  49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f
Score

10^/10

sodinokibi ransomware spyware stealer
- Sodin,Sodinokibi,REvil
  Ransomware with advanced anti-analysis and privilege escalation functionality.
  ransomware sodinokibi
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2