General

  • Target

    2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil

  • Size

    166KB

  • Sample

    230520-c94paacg6s

  • MD5

    e41395a425a5893dd132acf35c4a5b22

  • SHA1

    caa591c1738e8dc70816efa988ec2740f680e963

  • SHA256

    96eab1ef06e3aa876934084636ae1f28c95c14a5badcb69be370825206b4b510

  • SHA512

    b1fa4cc9ca66681ac897bd19a8ce0b1f9733bf1922fdd68888bde133e05b9ae6d872281522686056addf608d4277bb9bd2eae8312ffe5c23d4d6961ef586f4f1

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QXRDg+cdN:ZJ0BXScFy2RsQJ8zgBM+cd

Score
10/10

Malware Config

Extracted

Path

C:\Recovery\0990v5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0990v5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78237D9A41C8D209 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/78237D9A41C8D209 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GY6CkXHfPUK/LGaDiq1UHwJ2rKy8jDMmZY52ZGNHzjHYtP2lNu69WfEa3z23BlyA diVdrqRRx2GuDFoQV6mcXdOQTZHdxnDvtIpQY03zP2NjmcuxoSi/rywIzyATSflT l9eV+9iHoNv8NYTeRF8z3kFjVJt/4vFG9bgo7l7DBhw3KtUii+zSCHc/N3G5izbW F3AMZUHKyj68U1yM6FhMbcV5qp9iMGuiRkC3T9n7R4Oj1RVbjJh5hE8XHPrqzkC4 0VC+Md05C08XhDXOuxlOnEy1zeeo4SwSORw5lon/zqtJWv67BKs5Mdnb1LWAL7tI GJmcY5hnHew34vlbRkdkHzRQX4P5jtydW9Fb0uIv+GmQqXLbuOn9v7GJ/GxOI+OX Lx/k9LSrU2ty5Z7DbZsufe3Ec+sjAc7/dR09MYP9mgW6GSLaAaxA+1LvEQN7PDiv 8B2A3E7RCSJeVaQ0D0SsMmxs1OReaCrbCF53Tk27oxbgB+9ruW9jO2ASQT3g3xvQ eQng8CsN6err98yVs955+Mrk1VycHChoYehxInoVwUmltx6/ztJa5vxDzxcF2Lcw GE0kYnMAL8S/dNlGH5F8yDRc3IiRPSUVEWIjuqbPS9y9R2LfjWMv3vdQCeN/lA9N kcbkjr41G7Ax6F+w78XJbZXD/UciG8s571G4LMzDEgn8t/yXVvyI9GeMH+5Y1T12 5NgMVzJmTnNDrid9vyZp6A4bSZET4jXUrUx+Ks2fSt7GbzS4vr7gCohXxOmh6hJ5 VqQDJBLRUCWhRowR6pfK6MfTrSkLdjLhUuKFL1GYL5/JVKtzyPm1eGpu3ty/uLtC RAJNevbePr+pSywSa2Q3ojQuCzfhXS6XmrdVsHk8I74PLuDZIKEWs2JhomwcKhMc OXKVlSHJygV342b0lkFE6RJlXEYhtLlfWOgfYR5Dyu2FQ7FpnTSrUbIp6bheKMod D3isPON6wRuIZ5xBiou3YAu3VAsGgy7IN1TJqOe8oF9Qr+atUvJkYPlfO77h03rY 6IEmco5DMaRIL2nJ8dGAlru+ucwVxVycza3Okbb0c3Ka0UxvCNkQRDXAG1mEwPV0 KFRDtJR768Zs8C78nLnFfZk3cLxm0wfSl23bOIVC0iPcoa0UbOxvkbQE7/FSgf+j rHrexESlvIcCoGndujmYQW0gKcvhh9rkZZTh85VFfbbvRH5RKmqGDqBYETMzFoq9 Bke2EcDedBlBfMLYE0MrbYWau3y1UPVs41T05yo1xj3PaNpBeDspXHvBMOzYf0kC oD+4uzyhhDQ1T/m15oCL7piaZdLfHG2UHqysm51R ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/78237D9A41C8D209

http://decryptor.cc/78237D9A41C8D209

Targets

    • Target

      2023-05-19_e41395a425a5893dd132acf35c4a5b22_revil

    • Size

      166KB

    • MD5

      e41395a425a5893dd132acf35c4a5b22

    • SHA1

      caa591c1738e8dc70816efa988ec2740f680e963

    • SHA256

      96eab1ef06e3aa876934084636ae1f28c95c14a5badcb69be370825206b4b510

    • SHA512

      b1fa4cc9ca66681ac897bd19a8ce0b1f9733bf1922fdd68888bde133e05b9ae6d872281522686056addf608d4277bb9bd2eae8312ffe5c23d4d6961ef586f4f1

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QXRDg+cdN:ZJ0BXScFy2RsQJ8zgBM+cd

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks