General

  • Target

    http://65.52.231.153/order.exe

  • Sample

    211210-py1vgahgfk

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\4agrfsh5tx7-HOW-TO-DECRYPT.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4agrfsh5tx7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://wwylgcvegp33t2ytnsqa6klroq3kz643q5ceinkqb7x6232g3guit2id.onion 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/913AED0B5FE1497D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2ha2V19WEiSs6CxbdB8g61f7VdzmpLnYlkp4gywRY4Pr1vPx6LR989IACch1BXr 344GVX34oPrHBmxGjOCpd3oZlbp1ER4PBMWx7p3aDQmuR2GYOW7n9rN9Qfe4rB0 XUbGzQAJ4UlmNQ3HtVRnsURQT8WgbK9tCaPa0vQHOMCSXFAsWXuiaXIDCKx03dr uV2jxBdR8EJZfR82N8nKDZbSoSLXp8ZNufS7fgMq2GwdQ8mwDSj2QTnU3j4f0Gm Ao5o98BXrv7R7m7BqpZTXYh7b27D5lr0wewyUTmxC42GTBqr6iO0awPlH8NHB7b GEGed0JqXCmRcgaoZMPHXW1ZAPKrWFfwFcvCMgM1w11xyfwFqTx5vzEtMqeNpcT Rh0M9uXc39YUffDkfcFACSjAPYCzfC8MUhkQ8TwUT146XejOJG9vjbQ97z6lsh6 0AMA75wmMpvrLXnnuyxqZDNm3QlTJWLmv5E6LelTWdxFxuFlUMLw41gxwjHrTdd zeJ5QTrbPNeT5QHyIL996KYr3YQJlX493A7loyzSmu6jailgpu8gUegoFcC2Ci0 2TfZ5SfKTVqWLOzRVwtd0ZXoZeSfMw7QE4EP4IqOJkpKoHUaQKrFSE9c50Aa9A7 gYaSRKkWMGfUQtNARJ2PBF18A5lTEHPOJnIvNzDPqye8wtttszsRHu5bhcRVjQR E1RLnlcwcFmiNk3LQM1lPY7HYrqOvhrqagZGfiGIPCQMeMs1oQBJroCp4Kw54OA 4X6IqKwprGtVMIvmM8zkefi9vdtMVwKNBBWyiDBq1lUD7S0hIhk6FogYz7XMajT 45gUKv6DJ7Is3LeBcnMEyMNHXf79lpyQSRZHb8qvLda975mNU55jOffssY7oy7c dI1ZmvXkd7a2UvNKb3toptPCxvqZCBB7OB70FgAc6VblynL7eOfvFSwt3zl0E8h c5dnTyXE42RsTRnNKjt4yfQ25ON6P4JX8y9pU92JHJk2xkdcQlbQUDs6plrElaz At3tfS73Krkwp5YEVvvqoc3C4FDAtRxhrUkJ318KSsQjuRDBRgWT0tKh01yZO7J 33CFVUPKewkX5LTSnCCtN4er7JCTCCi5VjXqrLrqBW2gPWPVgiLWMO68YVIMS6I bOpCVynkcUVr0C7cl3rwd1LtHnZRWDfYFOaSjT3h28sC0gF5b2hSlJokC65sYWO Yy7lmlp2RAJ3fIJ2kid0dgNx5j0QnYKIg Extension name: 4agrfsh5tx7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://wwylgcvegp33t2ytnsqa6klroq3kz643q5ceinkqb7x6232g3guit2id.onion

http://decryptor.top/913AED0B5FE1497D

Targets

MITRE ATT&CK Enterprise v6

Tasks