sodinokibi | 1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

General

Target

1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
Size

910KB
Sample

210906-jd4sqsafg6
MD5

18786bfac1be0ddf23ff94c029ca4d63
SHA1

3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
SHA256

1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
SHA512

49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f

Score

10^/10

Malware Config

Extracted

Path

C:\1g9ycelm3f-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1g9ycelm3f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/773E26303FC88E26 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/773E26303FC88E26 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NSQS//xpao/ypiw7y4Hf0kXnrQ+XlkErmvbh50S6gSaDfBxrltP/0d83QhxMsLf/ EcwNzTs+ckdzTu5shvE+zHhpvGUSPsR+7axgBVqizCO9bzXIbUwp9jdotYVtSGTP JEIwRsgkk5qdA++nHUWjiZfHDvl3GxYxGVVXl6ij2lzIgzEmfoVXfhdA3J+cu9cZ xbcSsSndeO5DE0Nk1/0gBB65W4TnqKCgzVY6grfWJHCdaC0SkzpK3M3ZccIXJkhh n+n/RVM9aCIpSzirTH9/ZVTEsvJRNvSErm+YzoQNdHrVWNbtaABeSu1PzKSF1NUX DlZpk++r+jqKwzwYDZBByIFyhrA8oP11Il3xklaipGSOrdOm3eTmD/FIBk1dbMGn frmC1tbGQwt4MUcJOk97SXPpiQ8YqX53DsCxm8FQIsHUF+RqXTB/+q1bLPV69csX 0BzKukV8B48PUCXJz222YbJTRHaNNTFujmclhsxLMWltwadtVN/SVKHoNIspIZ2v 3NhI6wAFeF2g4/8DNPyPLX9Z9Qk+PJfZU4L6xg0ZOYs20xXxKroO+Zl3y7fSKrcP wha1+cRAm6QxNY69yplXJ9ZPmK/FrH0N+PLN5VfXMQp3GfFFwI6KbgMx8H6rrLgp rhkUpNoFc6t6TRBl43s1H5sBpoC9kVFC7yUwiaGgRHqAameJ+RTf68nJnYir3k6z QMqr758ie+cMNq6l8nd7XPC1GpnjBUvllHfhM1+v6/RbLH+prWm635wV9hCuLJsF yQR1OrIelq+n3al+uBkggSyXmgni7ZtBP+cpiYGmA0v1o8b/76cKuxwNaP2Cl6hw lTbfnQ/RcNdGob2L1yKVZOVQ/EuM7uVf/2LH0mHwSh72QBr5LN7ydSy2O0I0Zf0L AFeMRk3Ei245kQUF6Xce2n7KVnaC5bSWQiAMjIxXhnJSkW0w+XCc9L2074OD4R/5 /fHbHTGaAbY43JYP/4kIis18ff92ib1y7TYH7JsicRQciQ8Z8EBPD09jyHwP0t0d vcRRjxset6ZkMBDtLQX05F4PeCxjq61um6IGKi1zuDMkO+poBwp6BERZWY9kYQRG aG+jxvgKsNVSdDUR4cSJH0KNXGBd+mKjPCW6oAQ+bS1vUESUDJDSzCSxzQyI11DR mUpzc1akedKmnBkwga2Fy8EoqWEWYR0l+ooS/ltLxqWSWpufdi3lMjLJIytIG1NM W4Qeksk34AyGz8f1U/7+6Lw78JESye68V5fLff47Y95VVvFtjueD3jkQUvlGZfQX NyROtp7zQKoLpPjHMRU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/773E26303FC88E26

http://decoder.re/773E26303FC88E26

Targets

- Target
  
  1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
- Size
  
  910KB
- MD5
  
  18786bfac1be0ddf23ff94c029ca4d63
- SHA1
  
  3c2b0dcdb2a46fc1ec0a12a54309e35621caa925
- SHA256
  
  1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e
- SHA512
  
  49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f
Score

10^/10

sodinokibi ransomware spyware stealer
- Sodin,Sodinokibi,REvil
  Ransomware with advanced anti-analysis and privilege escalation functionality.
  ransomware sodinokibi
- Executes dropped EXE
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2