General
- Target 906c497e67b80e785774b046e9d100bb_JaffaCakes118
- Size 164KB
- Sample240603-d782nabc77
- SHA256 c80ded3fe04fe8fea1439d19c87d4c451683786c5bbdf9ddee4755ccde571be1
Malware Config
Extracted
-
sodinokibi
-
28
-
2792
-
zorgboerderijravensbosch.nl
-
stitch-n-bitch.com
-
1deals.com
-
loparnille.se
-
onesynergyinternational.com
-
banksrl.co.za
-
billscars.net
-
happycatering.de
-
christopherhannan.com
-
specialtyhomeservicesllc.com
-
wyreforest.net
-
ilveshistoria.com
-
cormanmarketing.com
-
goodherbalhealth.com
-
cmascd.com
-
artcase.pl
-
annenymus.com
-
entdoctor-durban.com
-
slotspinner.com
-
mindsparkescape.com
-
net
true
-
pid
28
-
prc
ocssd
powerpnt
onenote
msaccess
dbeng50
encsvc
thebat
ocomm
oracle
visio
mydesktopservice
sql$
dbsnmp
mspub
sqbcoreservice
xfssvccon
veeam
ocautoupds
steam
isqlplussvc
mydesktopqos
synctime
firefox
wordpa
agntsvc
excel
thunderbird
winword
tbirdconfig
infopath
-
ransom_oneliner
Sir, its just a business. Just read and follow all instructions and you get your data back. Find {EXT}-readme.txt and follow instructions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates
-
sub
2792
-
svc
mepocs
veeam
sql
altaro
backup
memtas
sophos
vss
svc$
Extracted
-
C:\Recovery\vuy4940-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension vuy4940. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5F2694BAFFECE8B6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5F2694BAFFECE8B6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9m+B2Ne4MoT9utgPpOMc9xXgOeVzzhnA7jWknD3UALk4wWapdvmpdwWrwBcvXO0C LJ0+Y+ID0tvpJK8PJ7Logi5q5MEi5ULbUN17RYPZKsGKcz4X9Hh8xIsNzp5CYfFp A3A2ElZqi8QKf2TvERurADYtKdYE9E05+ny5Rs/Xt2TV54hsMVf5EUboHqg54ZdS AnQzHPifpfZc8fKTB4qtm3QWR2l3mWOjP8uGmh3aAzKpcfaZUBd8zV6WPFcj3d0z vB/850i81lNVcBfANR7KB0pA3vnmYSo535fx1r5k1F9mxLhrDkG588l0AcN/Xe1U 4cwm9B5/uFcY7ktQBkaixlnsmkoM/dPGfVHj4eRvFo/qA+xIoKHR8AwtokrBGbxa QJW2MgV5lL5saKcI9JyAjXl79OIfyJkus0QjGIxjyrOKZ/lUP/DlImSKDD20ERKJ O9KIw3qxII0450EeUrhY29GQKCJ5VCc10ZbjkPE151TMfCMo/ppEsTeHzNHHz3PM f6VOigIR6H1cPyAqM6cCmMCELG//7F7Me3zshsUP1y5U0OI4OmBXNKkQ8IWF3syj R8pkw42QqxDQh/5GRDa6sHI09vIJ6L43UD1x044jUwDQs1VYnX/trCWxwt9/iVbB K4l4XPveh2AUNzslTn6wmtxujjrGDdZfGB2alNkSIeCGm7He1VzwR1gP/MnTi7TS xKb4SgVYMltXdC7ejkrC/LaapntAqaulqYrNoJUEWAuu/ezq9C2hHqu3KG30lOV9 AmW4PdSDjnN2i1CiKbE6VcREcdcq6QA6Vz+pSU+sDBesZKawwcfInAZ4xEOMws4G 4GH1K5Cem7I0JXfoqkBC6Ey9qfyulX18P359gAF51F9QyTB9kXzOyxGqUPE1tIh8 fPI1v9iL+6ykuyq4NWvGqgH57BewqycMafh5AL1yiumFUekQp6PX1WPlZoi1GT2K CtcXCQf8aBgYZ3DTlSN4S2NirumvTscDAHbbzaFrbugmexh0b637RxTVKWIyoqzH wEP32oCUVRannwQaQVShdssXz5jlEjDM0bsv41hriUNF92kLmJYb3ZkQr0t+Sf+V ffqRiCHBDvR6w56NNRGboyurkI6eUkSb3zK9wjo6294ngNiA6s9VPBxXulQh0dag PDEAiMliGKyPJcl0tpEMdtIuCgwClZzvJiRs7Gw3DAo8iVxv7ME246gVTcnR0LaE hwNUXgHNJclKtRwJPOU= Extension name: vuy4940 -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5F2694BAFFECE8B6
-
http://decryptor.cc/5F2694BAFFECE8B6
Extracted
-
C:\Recovery\c684bat8om-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension c684bat8om. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E4004981CA98FA26 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E4004981CA98FA26 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9xBJnGSpnxUqDmQElG5KfAo6JvALLJ3w/uhJEQ2laNF2sBdIsVWsBxxCh5TrYB8C jV0qOiHLsCNnv7g6MsjehisxKi2hYipbBCF5W2GuIsVhzN2XhN4ykBkDVmV1NxGm 1NUKteeIW2nN/MXaVZu/gr+otwD6bvkmKp/xdYzA27UkfrK39XUqTBrdIyDWHKF8 w4B0xiKu4YjJmPrpN78vNzGmWYASD8+pD6wAzf4PWzXapbVA8Plyq3cCGoFUwtWK lESeNgxf8VlKGQTxE+JTuiQGtIOH7k1DdsIXF++R7qByWd4msMDhMG/cIW7UlB/I kgnkXg6GaSplpbQePJ2RJoDoJ7lHWF8b4RP38A9MywqNqhf8C1OYaYDBwGZ/K6UY KldKbybtPWt+oQLO1p27jFfVbYPWfX4SJD5ULcL0j8fbsrrydBw5UNOf+VBYAHw3 xExjTrsZ0TjeVrsWMhNQ+rUYx8cki1aDbC2deLhzipPj40hWQdWiKm8wAzysuGCg MXzM29aVgae7eNwRbItDAAxNLM6S/ejQanQdLayVi+8ri/NuOQAAMSmBMgtPZyph OzBgakAYeEaYNjCUhk0eLomEbZCIy8+e5qkXOdCbB4sj6szmrucD24LMimRbhEmE kh/Tw/KNsgrrmYVp4cz9SWjpwD2eQSWPkqJRKzZQXn+RwAMJBx6elHfamzQjFOGl xC8GeDSZSv53C6GXmbHcpLO5Ke7sSC4lg7ToubGxmvRHltvsAw+yhsiNDCsiYuU/ rJkypgiGwwdgfxGNz4ljyHUMoQzBHuaNrZ7VuB8Hfufrky/kewXHu5EOyWEDiH3r E17F9fhqHcGzVlBAuFaq1w03IwoqzTfqDMoS+oJaU4PbkG+qmT3rZak2IhvtTHX1 C+oB37c7C03CxZrc7+xWxxObvQ5D5lrXqUWaDyYIlG6K2nRAQSQGIcmPWVwgEub7 N/VpKQtxFYEsYEUn0ySMr3p+x0/vKXEG+en4/Hi29ca9UYQMa9XnEwAkX9RFJUBZ Qw7rqzf7Mfxk8AdeC7cnawwrUfcNbY+8oHBYlwWb31aA9KR5d6JiUExgNOxkWFG7 2Tuc89q/BSsswkVKxD8I4zNTD8oSeBYaP7s0gCkA+tU02DOZBcPWBx902AY14mdK EghKC+1qz3DSNdk+kRZsP7h2I3pxePEg5DA/HeSubYQjmN0jh2Bx2/Id1TML0YZW EFaPckJ0A+lhpCGRhkbsxSuiJTlReoMCYTM= Extension name: c684bat8om -------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! A system of morality which is based on relative emotional values is a mere illusion, a thoroughly vulgar conception which has nothing sound in it and nothing true. Socrates
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E4004981CA98FA26
-
http://decryptor.cc/E4004981CA98FA26
Targets
-
- Target 906c497e67b80e785774b046e9d100bb_JaffaCakes118
- Size 164KB
- SHA256 c80ded3fe04fe8fea1439d19c87d4c451683786c5bbdf9ddee4755ccde571be1
Score10/10Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.