General
- Target 4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e
- Size 118KB
- Sample220305-vhtdcaaddk
- SHA256 4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e
Malware Config
Extracted
-
sodinokibi
-
$2a$10$6vrK6H6zPCEmbOMKlJrOQ.6kf8svBeir7qotbDCycO2pUeyzZQwsS
-
6189
-
ravensnesthomegoods.com
-
theapifactory.com
-
zweerscreatives.nl
-
izzi360.com
-
perbudget.com
-
kindersitze-vergleich.de
-
xltyu.com
-
pferdebiester.de
-
hatech.io
-
abuelos.com
-
brevitempore.net
-
sanaia.com
-
schmalhorst.de
-
sandd.nl
-
veybachcenter.de
-
servicegsm.net
-
desert-trails.com
-
lecantou-coworking.com
-
dr-tremel-rednitzhembach.de
-
saarland-thermen-resort.com
-
net
true
-
pid
$2a$10$6vrK6H6zPCEmbOMKlJrOQ.6kf8svBeir7qotbDCycO2pUeyzZQwsS
-
prc
mspub
ocssd
synctime
sql
winword
isqlplussvc
tbirdconfig
dbsnmp
wordpad
xfssvccon
thunderbird
firefox
onenote
thebat
ocautoupds
outlook
powerpnt
mydesktopqos
encsvc
sqbcoreservice
oracle
dbeng50
msaccess
mydesktopservice
steam
infopath
agntsvc
excel
ocomm
visio
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
6189
-
svc
svc$
vss
veeam
sophos
backup
memtas
mepocs
sql
Extracted
-
C:\pib18-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension pib18. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0598394FDF335E8C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0598394FDF335E8C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: URMUAyuUC61bBMxPAQDecFyPbdTaxY7z0lzT9IX7vyHNtLR0+FTtiMBOrphLlxx+ OZ6wQcxkaLmjphclTg15S8te6PoZ+wXsMI55N7TareIfUM7ZSkCd3ISuhNRN8emK IE+KXl0Kl9xuGaZRYnonwANjV1UWrHmL9n5PBn9i+oXO0wEf7POdBqYT8/nx0phr m96m9Q+hvegLRidz5H8yOeo3Jm0tcoBQ9J08qe/TnmuXEIyGhS+BP3gf6+zzGegC uGLafKvA+qAJnAh1BH7nrRrE9vsJodlydMIouPlDnOWsmX29GR7pGU0lSMGeaWk/ tBM+XVyB+nsrewT+0bvN2Cs7qmL9dzU4VYUQwi84AfDa5oWVvOIgL6YkJ324CvqU aFWDSU/kt149tTuOVibrpifMgvpb7RvUD5Fc6Egd53eEOBsLGhHJ+yt/Tu2rh6zC y2TBaSsDUId77+txw/doUKiokNktHNKIUwVltK/2nwmW+ROKuVJEB2mNf6aVUoJi NXB9yfLayjAAguG7RI7pndA7bRI/LmnSgsv7tZpWLPCNyh2DaY7q626G6jJX9sP7 iDAtiZFVAJUE0auqY+xgcQKaJZLaXJRJ2RHv8DTy1QmUYfh3g3x4H/ty5IwNKMLx Eq7h4R+QIqvW0YVuZC33c9/DDBGuvIdahFbEtoUj0hVIZx5+8/7dXr0n9qHS8APR IJVkS9kw0WbUkZMJGNJobD3vPoTPf2opHES/xyBewCRkzZXsfCzKYqVucQbk4dNS T8vrJd0ahuUjxKjaCHsseZCh/fbRuYkyt/2wglkHOwda72r99XJJ/zoG/mACFrmI flL9kGRu1D5YH7eJ/IBrbilG+aRt5zPMGTuitbog5RzQje9/6jfrq871v9onFDH8 pg85O4D5Ty9246ACKjdO0N0QM3buG9tTyN2VuHbxzfnrM2TD0g7krodcOBIqNC3w LFHt6NSO4ysN1S0ufBbBbHN5B3apGxaXrggbMbcsnTnPSRvN23vQtw2dyMHxhQMe TIgoiTefMyV8rZfwDR9EEvn7bjetpKiKIJyoFAvw2Vr2UqN5zl6LTyGA/q4ng37r F3kznZGeva17dMieuXr9nJZZCFDRiEdmDmXVK6IkHPC/CDedxsO9NMh7NxeG6r3G mLKVLWz0GHK2He5GRuzSPxkkVzKuXmuJRNAD1ngOfrCfKZFJPYyPn6GVgBTBcYR6 eJvw23+g5Ag/FOCaN5+UzGem70awEQ9M4DqctvFk/wQZPQXToArtVF9HjajqL866 TkrUPhD/EquVzxM1wBc4ifDflJg1Sg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0598394FDF335E8C
-
http://decryptor.cc/0598394FDF335E8C
Extracted
-
C:\6bcy7w7gnv-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6bcy7w7gnv. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D186C299A8E62097 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D186C299A8E62097 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JkakoXa7A8Cx49XsbchHEHv8fvllKlzhiTUt09BRRdK+MByAHqVQTqf/WxXAhetm QZx38OVp7sDl9op3tqwcbfh571qgmxOGttu9USR0DBbAX1SRfT1L+WTwnECyXCkY te7DHJMUcdkRbKWjhzqKoxAEMLB58LvQoBSz/7HoYUsgIF8OEdiwUt9lBINk2GF9 B7eOAdDgNGJrqIk+8+2p9sstXwmXog2QmlWN0kH8NgHl1ScUx5NtQfw3/1RHbhdL L03UxT1GFXfXMu2l8/XibfTPwWpLpW2csFI8mBlWNXPMh77wCm2mikL7iPAcWcEl YVBJoUUmjzyf8cVJtt4Ihhipk7PbGQ9ICFyyEMiVYtEv85yZ9bw8ZIqS/qgvb2Wu 1/1P9q5GUA1aX2GQgMtdJaVyIT7K6nsZY8yXsWAYRS3aDXUmTWXdlOATnJjnvSrD /Glq94aXlLNLnXDSICvtB274sAQte2QHagRq0e/8aVc/AtS545EaluScnqkckcII hecQaBh18a1oTCkAPjAwUodMKrK5vSrHkG1n3Kx7R4DWQpM53jxUEbt6sV0qwhHe HJvZMzfrUew5CfNxAjRGiS4MR5Kkazn0/5wZF7QXLPDJhDDX2EU8+fNoY2qo50vI rcOSFQXp0rbEEXmcdfMDNfvuUTgyZ6VxVmW61dPCfY1/DXkRmmRvmRaf0CKOcmwn 9LDwrqKAN7t3LFPpgKQ96wQWwiDEX3yXYpdsXJ7i7UFD+D6mpApxhulATzImy2di P0NVK0sMUIrh1jxhu7cQ2TyLG3Ges1hV/btlroj3a/QS93svtmBg3b2CMqLS4rsP e4pI9/JaNKxbrji1GADzaHx77S9AXP5ZUCJx0fKMBjAAY/I3sBYsOMfQzEfl+wZO 6Hzl9JcAF3D+tbrsy27RtJRi+FyboacOYJf6GTPfDIvnTfuEYNKfI6iPvUOdvYUi t8d+bxWoYImHuqOZkCGRs8kA3pjJGFUFBkynwbi+My6HofbtMupZF2F8dc10/jzd I81kNgTYGO6keC3goS5KVx6OhTNJBJK8uYAXLdti/cx+beaC++DPsWsiNpRK6IKq eA8n5ni1FUs6Pnkams6dVP0q9ZJrSzlUfUqDzNGg0bEIBgxBcf/JjGMCXx1qs5La f8qq6SsgW363/IAt2/y81Wby3U/gXw4h1wvZAw5jKk8T6GKFKx/KXL9aUxuRZk53 1nZD98Clit7ooKUIbaD49rmz3eFrJ+lpwZV1LYfxnSFZDWb51a4jV5q+RfWPT7wS EdJfftRMJV0aVAgFbVJr+BYSvSTPkjG6bHHCPQv7bGdYhJ/Ggus= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D186C299A8E62097
-
http://decryptor.cc/D186C299A8E62097
Targets
-
- Target 4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e
- Size 118KB
- SHA256 4e56a1a9421c841bbaaf4a7c45f67f91c2532165a2deed43351de71553dda92e
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry