General
- Target 5588332496c607b20af0b1c0e530d3713c519c47c3f9c31536ebc7da9ac342e2
- Size 118KB
- Sample220124-cgvkxaaaek
- SHA256 5588332496c607b20af0b1c0e530d3713c519c47c3f9c31536ebc7da9ac342e2
Malware Config
Extracted
-
sodinokibi
-
$2a$10$9z3DtalKQiKTMBT9m39oj.TEuRwza/CXgrwJ9eF8xZQQ/scXDie7u
-
5223
-
michaelsmeriglioracing.com
-
thailandholic.com
-
jolly-events.com
-
copystar.co.uk
-
modamilyon.com
-
worldhealthbasicinfo.com
-
helikoptervluchtnewyork.nl
-
myteamgenius.com
-
krcove-zily.eu
-
cafemattmeera.com
-
parebrise-tla.fr
-
stefanpasch.me
-
psa-sec.de
-
crowd-patch.co.uk
-
manifestinglab.com
-
architecturalfiberglass.org
-
celeclub.org
-
daklesa.de
-
evangelische-pfarrgemeinde-tuniberg.de
-
euro-trend.pl
-
net
true
-
pid
$2a$10$9z3DtalKQiKTMBT9m39oj.TEuRwza/CXgrwJ9eF8xZQQ/scXDie7u
-
prc
encsvc
wordpad
powerpnt
outlook
sql
tbirdconfig
dbeng50
sqbcoreservice
excel
steam
firefox
visio
xfssvccon
thunderbird
synctime
ocssd
mydesktopqos
winword
agntsvc
dbsnmp
mydesktopservice
oracle
ocomm
onenote
ocautoupds
thebat
mspub
isqlplussvc
infopath
msaccess
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
5223
-
svc
backup
sophos
sql
veeam
mepocs
svc$
memtas
vss
Extracted
-
C:\3sz4n-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3sz4n. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BAEAF2D63EF4DF3D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/BAEAF2D63EF4DF3D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ThKzeZTN8uDFNgCbfkHws2O5xXvsB+DOPpZeU1jz/FO3pV2A6WSGRqstkjf4ZprH vBWVjlB6OJCLCqCpaPL3M/LXRfR6/fqeXKA3N6Zoi1Tsz1WomMMl2m+bSIsN2voq UB2clD1qe/BrZH4imWWT63eisIgncAyPwqy7+O5FsPYzv45U4GSMbDWkX8RCTLWq M1M15I2hECuKbtQHSKKk7XoviOG3AEGrcQepX/JODkI6TSABZQlqAz7A8WfVXxZh GTl0h0Im1sZu8BRyAOOFFw8AR5dN/kk/Ak0IySEB73yvJgLl5/XH0DmonSmHrs/t VI9UNEnsNpXiTsVC7VZa8dVXFjBtweCJse74jy66seHuZvJ78uWE2xsPMDwsS+wa /UX6nPXou/fs7+6j4AVpXa0zikcWknrxVg9YA37DpTPex836G0W6Kzf9IFkxBtDx Jrt8wsRsqriSPpnayL/E0HgH4K7J4ihtwkCvTMfuv2QYm5kustn7WD3qffd6xvDt dEmOqF5p4nMeTg+d4iKvukbtjPTKesIXbPgpa4AECBi/WqI5Aqbr4kMBbW0qFveK jbOLQuw1LfgcZJFroNpe+iAj1q8MaKZmXHR51JL2hfa2gU0TEOaXMFFsg3i/vYad eQtmwZLMoA8ZJqfEUUPdDnsjH3cRTmfVuLdx+XZ/tYSdjDnUJLTWheT4AbcC3Mu3 bPmjj7PT4snV9RnBkX0McP5D+k8ixu5fjwLZYIAnA11NYmwzrrt2kyJkL5DwlBaH SYS0/AdzJHcBJ0QR7t6a5Jx6ppdoFMStt9nijDZ85QyuXeyP8AAobVHklwgLHASx qEa+OUrd7TUFALeDgVD+MRcnGptp72mpK4MPeySA89Jt0WTyaYgnsfnjep/fe85m rQVjcR3sQD2qKwsjQtxNyDmNsa1FVlOGxjZrBfWLRcyKHVJT+GXen8aBAsQloeUn Q2Xo7PP1mztpSqktdnlYY0H/cwA9hjHF29UDr7mO4dw3jh1NwzW/qo22UikbN+ye GyEt2OLM8meY8uwVj5HFzV7l9CN5Bka33eNtD6DsBder9tcZiHt8jgXhxdtkJ2IT bjjhkk4pggGRlSsx2C0oIT6fqf5vSzh7HWMxU5CDTcYRZ7o8TLbCZ6jVRZJrHSUf +UbRyjhsPDoOsmWHT0NZi9AA55AAgmCOmUFmeiE+KYCflEu73rK3dFhV6ysocbJw G0Kxo/fs+DjoU0sOLCHIuX8tM44Cqc7gnQO+rg3I4NY15atszYKtAqkoWHRzXRRk TwtBeeTPUMUZEGVEzqoUDd4jhqWaCg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BAEAF2D63EF4DF3D
-
http://decoder.re/BAEAF2D63EF4DF3D
Extracted
-
C:\b2216h-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension b2216h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E1DE06CB83888BFF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E1DE06CB83888BFF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: CQyshNJLwCm1BfcUuJGz4HBrYqstQW7ACy0HAOfzXliw8BE1qy0H0/WgIXZPnn+Y xNRXx/YHu07dgbI/Thf6nbLvQWnLy2z/cf01iImP9XzGuuB78pwVhpRFa3gRPLat D00Sex3wJJ7PqA//TUufiB+3DXE+lkq7FQ5+7JRKi0udTTD/nZpf6raNABoWyGqr EUiIlq3r4J/I0QazEtk6w+ApYWp52/Ge4l7zZ5Qanva/QbZr1kc8noc2AdTZnyKH 7jRNIpv8pEHypNyFigr6G5TQMxpq4K1Y6s9hQY1KfVMXAiH/ac1eUxaor2YNVFGb TA1TJce43nF1OGLe48QTw1VCSdLqFbjntn0XgOmhEAyuwF6v6C4iBRXnI1aLEt6x 7EEcPKGcksLYUSbf3VSG2cO8+QJ6d2zMY7wwbens2bIeuUBBGfdzGWTYP94mKUOc 65sRgnPdSc3nhtW4WHc6njvvRLtGRuAB/mY9NcwkZ4EPDMliWc0p0hCquTh4duUJ E5TuJRbuncbfTZ7iT+O27IBfx5SVyl1fBLKugUCatwIF7v0w9qQ0oHlhn2aRznmo DmSGR+Wm8ADsEQRubQzpv7Ik+2LL9Maten457SvDBf1C61GaWqsSNnlgNxvugqwx dyChCY7NODoUKn2zed4Hn+u0iSDUXtT35QCS1uLObApWgy2KkvK6029Rsp1ovJyG 7UU5u97EdChBPuwQgoeYrlH6wvaNQiDVEeM5YmBw1vbO3qTk8m4FYaj7/gzVscFu +uGCROHlXc1tzjm40pQKeDIRiVcdOrvaHQCG2SbGo8ncq2XJfq6CM7Nmcs6IHsHq wBt1zjacaCbbPwa9UsUIw9SArX1MadLhF94vI7SY2WxOvRF4Fp5vFp1MhINwL85I zj1xB9ZlgCWvFxzrP1Ns5UdwTaU+tJborstx/tYG6qEn+AyUOIvM6ezoM5C15PDx WKJ4mTcJdtgtd6aDEmh7rymmc/Qww4chUjKWPG/5mrHIkvVOBLMuLs60XlwqgKuN sC2ywq80Hx73Gd2NLqwGB1nDSkctFt40n2ZUL8mzZb4JdADIBUxREQRC4J/8683P jvAi6tBEsNKhguwLefWCGeD5fweBcnIL0kZNo/ONqDjl1OiT4D3LfZ0DiTR7JIqY AfML+yOIpXb77ljY+JhfdFDvDn+mOJOfs23FO++OMbeWPzJ1BFVRHEgomyzSmESK vA6ftrJ9HVatTiBKrP5OoHbCfiQ7aHI50nzYUm7nB7TkJl/PnE5pBD7RihaEXglO gW8UwRiyxJmwi5OnlyPEZg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E1DE06CB83888BFF
-
http://decoder.re/E1DE06CB83888BFF
Targets
-
- Target 5588332496c607b20af0b1c0e530d3713c519c47c3f9c31536ebc7da9ac342e2
- Size 118KB
- SHA256 5588332496c607b20af0b1c0e530d3713c519c47c3f9c31536ebc7da9ac342e2
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry