Resubmissions
05/06/2026, 00:40
260605-a1fjzshy911003/06/2026, 10:51
260603-mxtzesew3p1024/01/2022, 02:03
220124-cgvkxaaaek10Analysis
- max time kernel
155s - max time network
163s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 02:03
General
- Target 5588332496c607b20af0b1c0e530d3713c519c47c3f9c31536ebc7da9ac342e2.exe
- Size 118KB
- Sample220124-cgvkxaaaek
- SHA256 5588332496c607b20af0b1c0e530d3713c519c47c3f9c31536ebc7da9ac342e2
Score
10/10
Malware Config
Extracted
Path
-
C:\b2216h-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension b2216h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E1DE06CB83888BFF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E1DE06CB83888BFF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: CQyshNJLwCm1BfcUuJGz4HBrYqstQW7ACy0HAOfzXliw8BE1qy0H0/WgIXZPnn+Y xNRXx/YHu07dgbI/Thf6nbLvQWnLy2z/cf01iImP9XzGuuB78pwVhpRFa3gRPLat D00Sex3wJJ7PqA//TUufiB+3DXE+lkq7FQ5+7JRKi0udTTD/nZpf6raNABoWyGqr EUiIlq3r4J/I0QazEtk6w+ApYWp52/Ge4l7zZ5Qanva/QbZr1kc8noc2AdTZnyKH 7jRNIpv8pEHypNyFigr6G5TQMxpq4K1Y6s9hQY1KfVMXAiH/ac1eUxaor2YNVFGb TA1TJce43nF1OGLe48QTw1VCSdLqFbjntn0XgOmhEAyuwF6v6C4iBRXnI1aLEt6x 7EEcPKGcksLYUSbf3VSG2cO8+QJ6d2zMY7wwbens2bIeuUBBGfdzGWTYP94mKUOc 65sRgnPdSc3nhtW4WHc6njvvRLtGRuAB/mY9NcwkZ4EPDMliWc0p0hCquTh4duUJ E5TuJRbuncbfTZ7iT+O27IBfx5SVyl1fBLKugUCatwIF7v0w9qQ0oHlhn2aRznmo DmSGR+Wm8ADsEQRubQzpv7Ik+2LL9Maten457SvDBf1C61GaWqsSNnlgNxvugqwx dyChCY7NODoUKn2zed4Hn+u0iSDUXtT35QCS1uLObApWgy2KkvK6029Rsp1ovJyG 7UU5u97EdChBPuwQgoeYrlH6wvaNQiDVEeM5YmBw1vbO3qTk8m4FYaj7/gzVscFu +uGCROHlXc1tzjm40pQKeDIRiVcdOrvaHQCG2SbGo8ncq2XJfq6CM7Nmcs6IHsHq wBt1zjacaCbbPwa9UsUIw9SArX1MadLhF94vI7SY2WxOvRF4Fp5vFp1MhINwL85I zj1xB9ZlgCWvFxzrP1Ns5UdwTaU+tJborstx/tYG6qEn+AyUOIvM6ezoM5C15PDx WKJ4mTcJdtgtd6aDEmh7rymmc/Qww4chUjKWPG/5mrHIkvVOBLMuLs60XlwqgKuN sC2ywq80Hx73Gd2NLqwGB1nDSkctFt40n2ZUL8mzZb4JdADIBUxREQRC4J/8683P jvAi6tBEsNKhguwLefWCGeD5fweBcnIL0kZNo/ONqDjl1OiT4D3LfZ0DiTR7JIqY AfML+yOIpXb77ljY+JhfdFDvDn+mOJOfs23FO++OMbeWPzJ1BFVRHEgomyzSmESK vA6ftrJ9HVatTiBKrP5OoHbCfiQ7aHI50nzYUm7nB7TkJl/PnE5pBD7RihaEXglO gW8UwRiyxJmwi5OnlyPEZg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E1DE06CB83888BFF
-
http://decoder.re/E1DE06CB83888BFF
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 15 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5588332496c607b20af0b1c0e530d3713c519c47c3f9c31536ebc7da9ac342e2.exe"C:\Users\Admin\AppData\Local\Temp\5588332496c607b20af0b1c0e530d3713c519c47c3f9c31536ebc7da9ac342e2.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken