General

  • Target

    2023-02-08_d3624ff1fd9a8d7866a1578359716a55_revil_sodinokibi.exe

  • Size

    179KB

  • Sample

    230209-rx1t7afg7z

  • MD5

    d3624ff1fd9a8d7866a1578359716a55

  • SHA1

    66813f8263a1c8a53e8d6fece8a307e2ba5fa342

  • SHA256

    60c49baa290de5336e5903286d1e8ff8b8b833046a63be00966695dc9d3f6dbb

  • SHA512

    97da304352f0a37071ae935879af3531e33dd580e50f768521e2e12986f155d7a1b09e755cef20f720f3e9bb9608258e2fd37f32e5aca5cf611cfa4dfa8e0ee9

  • SSDEEP

    3072:rNKQ4JTBg0Q8F63VETed7/kBazzFbUL7npOStSWQ:rNn4FQS63VE6F/M4q30TJ

Score
10/10

Malware Config

Extracted

Path

C:\q29go-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion q29go. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9D90AD6D62A20EAD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9D90AD6D62A20EAD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zHxAX6/L/26OaYCeensFtXrKjXlbMUk+Pv19aINzAhHWpvgfJWPWU8uTVRj1+Sx0 rb0wGw0PIpnM53O9gLHqZQWr5QYaV4RMQM/kN3WSpWivGHqf2PDjhy5n3d5cktzf bDUF8Z4ovMJw8xymkUwzkpIZ1n1pzZY4Vzn0w0q0T7o/JG7UkJ3XujhDmZfh6JN7 Y2RGKFotiQxd39v6UZT7i0bz0nuBZffbXQ1z3smLVFBsroteoXua1ALEecjjrtWJ o42VU5EiI3ga9dYONkqmFQe5GgQsQVHPcHzekuSYfcxUCE6DBl1jV/s+QYa1yv7n TDG7b8YHsjrzoIuJrQtS0DoCgQpnRdUyObMVRl2Or/WuIFGuyeVjg3OH7AjJT74b r9a8B7nSRudR/u4vCgEytxjvBRzk+aqtwuxyP8mnB5vsjPHf0urvGJGCvclksQbl UG3AEJD2EKB5EUR6/2HftCprnKJOibpjBVKLHHGWJq8KyVorEWBBRl3OjPlh4Dj5 Yn1SrQwaE6Sfm4qUob3WdazfMuI+GeKsRsGIBm4QoS0YP601WlRZYNs60fs/MjBv v2u0kRWP/ylvjjK5ekykbyekz4Pg+O8r1x9KLN8zAS5YVsVvvW+BfNmzQfdfk3Rq Jx6WD1gT4C6plfknThBDiomKHGzW1IBxfQOa1dlPRx/vX1JaqxC/Fqk5TGrx/uwq 4OrDm5g8WQNmMSR27msGkRjEh7o9Jgzkst+9bZCTz4Nfl5pvvxBYTSiv+6tePVPo dXBoE5FDIHr/v5T2o/E+BBIfjpBV3PvUk18gmV2QWMZaoGpvEAdb/QU/BxgeDgBM uuRE49DPFgkTbC9u1i756gZjtbAeY6q2jCe7wUsvIv8ntjJ2MdQGm6A/wZNL0wGC 4JW2qd0mIjaWfKq+Y+4YzLnCwy5aA/40T8Aj2YLAmH6s9zPqF4ZayNx5VV4YJCQx E9MQrUK/yhOR7RAL0qrpYzzVRwGMHsEeM4Rx02Lok2HRBEYQ1DzCvMX/N3W/aEGh CC4tZRd4mWdiHethCV82VKRs0RSk1TPb6ppCfa5KMqobcyzDh9infBgnD/FMpBpO vYooE8KCAMX3oBMHrZzjjoB04hzN1vABT1n1fPvHqDn1LRozNXoLBTQPMzg20kN+ 82R8/A== Extension name: q29go ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9D90AD6D62A20EAD

http://decryptor.top/9D90AD6D62A20EAD

Targets

    • Target

      2023-02-08_d3624ff1fd9a8d7866a1578359716a55_revil_sodinokibi.exe

    • Size

      179KB

    • MD5

      d3624ff1fd9a8d7866a1578359716a55

    • SHA1

      66813f8263a1c8a53e8d6fece8a307e2ba5fa342

    • SHA256

      60c49baa290de5336e5903286d1e8ff8b8b833046a63be00966695dc9d3f6dbb

    • SHA512

      97da304352f0a37071ae935879af3531e33dd580e50f768521e2e12986f155d7a1b09e755cef20f720f3e9bb9608258e2fd37f32e5aca5cf611cfa4dfa8e0ee9

    • SSDEEP

      3072:rNKQ4JTBg0Q8F63VETed7/kBazzFbUL7npOStSWQ:rNn4FQS63VE6F/M4q30TJ

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Impact

Defacement

1
T1491

Tasks