sodinokibi | c249af7c493de4fe8a147333d5197461a6daa1f60393b5bdb5b74128dfc17b9f

General

Target

c249af7c493de4fe8a147333d5197461a6daa1f60393b5bdb5b74128dfc17b9f
Size

1.1MB
Sample

210615-s6qx8mprhe
MD5

ec926f3d4237e3aa70852c25c156df18
SHA1

c1d7970a15b0d4aa256df6d76e6862ac18d0c9b8
SHA256

c249af7c493de4fe8a147333d5197461a6daa1f60393b5bdb5b74128dfc17b9f
SHA512

b5a175bb9fbbf53f6c2c5ea0926ffdcddced47c3cadb50eef70d6bc91cb34094d97c20e51e6f693762bf9bc6aaf2b2803e4ff9173b97083bafb5db4fc9f2c8df

Score

10^/10

Malware Config

Extracted

Path

C:\38ir1yt23-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 38ir1yt23. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/356713AAA308D158 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/356713AAA308D158 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: d1ElBD6tv4hDpXBPN5XeybQ/qznAB2i+3HTqwDL8ED8lxaZDyUYpTaejAs1ye/ow GCUpgzse2U2z725S0IxCWQ5l5CwbxuwWYxAnCQnLVWdNIXryRGxvUKWIFcpEOtFk 8V5PXBWy2wd4OGNnFHo9jy/n8un42ZO4XKvTnTZjokr4MaFnnXr7pNrh1KZ3CWU4 y3tB+/hwAOXGuxDblD1dqW05Zw2dMqA+tEfkQJMwKyMko+2zgDUZOKkd+u8es/1E qwAzFdOf3s9TkhUrPIZ1QF0PlBUQDrZBGkk2Fel2jlUU0AQsZTdX0ifXoKLwFoUQ VMRtvdy2MRAu7vjFtYUL1GE6LGOmUBiDeZymda0EhulyaNZ2P1ssprZCEWIF2O0u Jo6UFlWt3ZHb5+sE6TlbCkyT3lAcI3KmSqmaPPk1mvxXqEGKdNe8wI3iT3hbkG0/ B9oO1I6SxYhpu0T6Ppn+NBtl9rvEaEnXZD1lD+PgDEWJTTxxUA1iewWHo6obBiJ8 xgUkvX1v5CO2bRrmx4Vxfj1f56/zKGlccwBI3zySMWMLk+bE4GJT01HKKp9POcCN /kR1svafycZVQZznW+VL8ybQe3Wm2QfjO6NJ3rXybmnnbYpx8ayQXy0OwGgsv0Tp dbkVFGD+fsJ0ZQenZ1npRFvw80W282LeB9bv+7t3mpHm/ejjlagalB+lcHWbnnHy Qer3Q0sdfn6xuLV9F0AaOljTWYcX2ZRUDvBuf9H3KcHLXfT5zu4PHZCUMtJF4xL+ EA/og0Y6doRwD4E0efFEQgOn1bWp0k0a1bDBgOp2QCiHZCvchXM9dOCBeA5OHF8e 5JIC+0eTGdUphJIk/cfNlGEAtL6XZwzXnDwJUnBmHtX+2QUPHUaXHaiRVisrNEMU k2ztsMuRCuFqoU1RfTgvBm9T81giEYZD0Cf2DzWNpX5tCHgNswlzJ65+xCSaSg5R katwKwcQq2J61pJRAEbH+1Otg/J2eTKevDUjMPpl7dY8m8gj7Zp34lZ5O0CQaROW GRdaI435MI1uburiPIoWLnbvnjx9qcp+StepaJKxys1TBVYJxBL6yL2TLKdztcJC vyq9O5dZcJF+coXH2Pw/gmt+72WPFn2iWWFlH8J10Z1RFayiy1GoM8LXNALR4l7k ICbTTHyoL8/HxoNxi+YYQBRxEndA6Aej94Q+wFSnPgUqyIbrfov8SFrNdenwJzPq 6EIhft+FI/Dz/XVQCNfnZ1XlQQE+v/GvtEdivi09POsyW3QuBxFybmI1TZ1jY0zB G/4PbLNbieTsw/cv ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/356713AAA308D158

http://decoder.re/356713AAA308D158

Targets

- Target
  
  c249af7c493de4fe8a147333d5197461a6daa1f60393b5bdb5b74128dfc17b9f
- Size
  
  1.1MB
- MD5
  
  ec926f3d4237e3aa70852c25c156df18
- SHA1
  
  c1d7970a15b0d4aa256df6d76e6862ac18d0c9b8
- SHA256
  
  c249af7c493de4fe8a147333d5197461a6daa1f60393b5bdb5b74128dfc17b9f
- SHA512
  
  b5a175bb9fbbf53f6c2c5ea0926ffdcddced47c3cadb50eef70d6bc91cb34094d97c20e51e6f693762bf9bc6aaf2b2803e4ff9173b97083bafb5db4fc9f2c8df
Score

10^/10

sodinokibi evasion ransomware
- Sodin,Sodinokibi,REvil
  Ransomware with advanced anti-analysis and privilege escalation functionality.
  ransomware sodinokibi
- Modifies Windows Firewall
  evasion
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2