2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
General
Target
Size
Sample
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
206KB
220124-ct8cjaacf7
Score
10 /10
MD5
SHA1
SHA256
SHA512
0220e281b135f0e32a2794fefe4e6aa9
05227068220cc142487806cddb262561a84e7538
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538
Malware Config
Extracted
| Path | C:\41n10w-readme.txt |
| Family | sodinokibi |
| Ransom Note |
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 41n10w.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73B88515419F2565
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.cc/73B88515419F2565
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
BiTzWNK2xFj1cXIbqVkcVXMlIOR1SbAokcpyZ9h6TujDxVL3YDE/1oEJguszh0bF
WEVL53IuvxxFMJU8Z3BhITofqf2dI9H9XcJXgXewhqTy4Z5DJTv/KQf75UYjAbkZ
k2IJeIKJIecbxNE4PBycvPAfyPHpNkammngbux8wFlxXbFCs5KTcbv1DKcz2qrLu
gmObsLwx3bwhO/sDUoBc/cqNqeN1fps5qJuALYAugaM9Ew8ilHqTNY6OHX7Ztsyi
dlL5Jh37sMRxInqdSj61zj2kqEEI3gSLxB/JKqhZ0q29NFsYTBzrjXh+9ZsWTEMz
UAwj9EM0E6YccY7UxyBCQfOzZAD9GLCL5QiSrUEShGo+Z4GVJmtV6++pRAY7HToX
dDpmB4g2sBqYJMrf3DdYhjPU8W37junrp1l/GcT3DnhVQu2zPJfIm9kUxnaB+EdX
ZlbDjyH4qIIJPhnUPu0lca/oZeARtEje/kL8706IfZ3zJymJ42NlVS3p3Cyn+mEs
GsX76eJ6iuxJPRGbiIcqVVe14jSZfp2Ap58qIZILB3AEyd1jp2f8URMZJ4cgk6kW
FSsosi6NxPtsbz1qPtBlUuVpqiXBAdDoS+wzi7iT/DH29HcdhMDuxypnDHN2Mxrc
Pt72+kJbGahIdzYkqVRT0nJbQbJ1Eyh3wIU8Fvq1uBov2+WAjawIxe2F6lrlh3UI
N5+WQ9GRqbXKEjPm8zciNsL+dKm5/iYRoTjk+nuIX0TpdSJkzIDcO2c7CjARrJnd
/SRw9KcB1IOHlmbG0cJ3q/XQsR2Oc/clHlfGNBH/D7KjgJHZGdSaHogOVbxyzzoI
OAo7GsVtcSM69pavCHUAm03WSnieGSfi8UPUfTXrnUnKKSoVjv7CVkmjpMs0ci7D
X+L0TSYcsJ9oWGaFnCnLlBRGAsKiwneBqDt83NItn8uV75midez4qVDnCsSqy60C
NiLNh9EdYgc6Gme+WoepOIS21fU8N7WljOSq+8QiToDRsJfHqZrSjZgQZuy3HTw7
tRA7gEAy5Q9NSiK7ALMyqLYgyPFgfzUTVJK3Frv//VP69jSXstDnw41OVmycIKBW
6VfTMXObYDNdjJyjV2jzeQCvMbOx6B6w7JhXveiqc3IAaxxbf+fXsJo5dHRpQd+D
cfcKXQ==
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
|
| URLs |
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73B88515419F2565 http://decryptor.cc/73B88515419F2565 |
Extracted
| Family | sodinokibi |
| Botnet | 16 |
| Campaign | 2932 |
| C2 |
premier-iowa.com turing.academy physio-lang.de rarefoods.ro palmecophilippines.com ddmgen.com omnicademy.com baita.ac cmascd.com nationnewsroom.com belofloripa.be babysitting-hk.helpergo.co tages-geldvergleich.de iactechnologies.net line-x.co.uk richardiv.com goeppinger-teppichreinigung.de dinecorp.com hawthornsretirement.co.uk kerstliedjeszingen.nl ahgarage.com endlessrealms.net 5thactors.com myplaywin3.com apogeeconseils.fr jacquesgarcianoto.com traitware.com alnectus.com eatyoveges.com protoplay.ca paardcentraal.nl electricianul.com gta-jjb.fr ilveshistoria.com testitjavertailut.net phukienbepthanhdat.com georgemuncey.com invela.dk pilotgreen.com coachpreneuracademy.com medicalsupportco.com lyricalduniya.com mustangmarketinggroup.com uci-france.fr sbit.ag mrkluttz.com tellthebell.website agora-collectivites.com rozmata.com jefersonalessandro.com |
| Attributes |
net false
pid 16
ransom_oneliner All of your files are encrypted!
Find {EXT}-readme.txt and follow instuctions
ransom_template ---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.cc/{UID}
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
{KEY}
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
sub 2932 |
Extracted
| Path | C:\wp8b39-readme.txt |
| Family | sodinokibi |
| Ransom Note |
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wp8b39.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.cc/3918789EF4C00089
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
6h6M2j6IMvJqmVMtOsCKSqGr7yNH14e94z21T3vTDW0td9HzBYt8ca4B28/P+pUr
S7EKv7lM/ZzHS4hbn0UvKcT94bH+oU2FCQogEU3MeOKhsJXpq614y97K9vvlkXR3
s5ZVaRjQ9ii9xDrJDcXWGGPczRxkHCo9EWtUt8Cc49EjTB1oE9xCGnvA4HXLLY/4
Llq4qeWM0l7n65NVsMiatQAUZcqLLuhnawVwA6VgdZu0b5wVKT90za3COaSx/z2r
2AJvIZJC9Dg3LmVYzWS1Oq7YTxhqvbx5Ga20+g+8wFyylfZGAUnLL7ekUn2qtTqb
zZTMHYd2i0omriLwVuejfPoYK9MJ3pahvQcY/hnHYe9rSHXAKlzEPXFE+luOMToY
zlIiT1SG32TDZ1wq9KmEPX1cVY3SiUQJFNBwc51f6rj+4q09EdsP75vApNVAxNuT
S4+rCaF4+Yoa+PDrDqxXJSfHfdrHXbY/2sGpNWs4hQpzKI1Ze2wJcphCMJoVzA6q
enn2oiabmx+lizuEr6rqpjyTmexGtL+yExMYMuKfc124IY6II4xix/5cjVBAOIhg
Cd168ZQtjXX2+Ld/NlPZwGPehDDlAyUY1Cf+aUies/dowBlPDt3w2ZTy27bEqX0m
8In70W29YTRiqDCVf+BKp9EvMERXTHTWERW9UOf3ONwmI9W7zZk9eoYNXPpQHY09
WGhYmhY/wiMSuabXHYQBZ1jj6+MY4VdbNerCIu9Ga+t7lostwXXsvPTNBy1dLzhH
s/L/yTqtfc73c/NevD/8fCIE9wd5RXRnzR00oaytU+HV8v2CiqLdmy488mXRGsA1
NdntFfwDcv8gaOJU9IOWK3BiRkSPREerz4fkz1JEap5xb5aCb3isdJC3zF73WGUf
hGX8CZD/cGO2GLcbFsgcXsbTWA33voc5q5EypdickE6T4JceGztUFiYQbZxu9X64
360Ohb53XAkQec47LhfgiPNjc8CwLvyF9Bdkoij3JTtipbCuvggDS9u2kBcHcO9N
h3scNZL9XmtOuvS+X+LXpe/yiA3S3MzipZUIdgmRDPyYslS++p11z4Cq64T1iefL
+QMWEbofsj6Mn/B7WjgAIGs3wCmMkSJwFum10BsHL0JEaowympoZTsS8pwA=
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
|
| URLs |
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089 http://decryptor.cc/3918789EF4C00089 |
Targets
Target
MD5
Filesize
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
0220e281b135f0e32a2794fefe4e6aa9
206KB
Score
10/10
SHA1
SHA256
SHA512
05227068220cc142487806cddb262561a84e7538
2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b
8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538
Tags
Signatures
-
Modifies system executable filetype association
-
Neshta
Description
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
Tags
-
Sodin,Sodinokibi,REvil
Description
Ransomware with advanced anti-analysis and privilege escalation functionality.
Tags
-
Executes dropped EXE
-
Modifies extensions of user files
Description
Ransomware generally changes the extension on encrypted files.
Tags
-
Loads dropped DLL
-
Enumerates connected drives
Description
Attempts to read the root path of hard drives other than the default C: drive.
TTPs
-
Sets desktop wallpaper using registry
Tags
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks