General

  • Target

    ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

  • Size

    115KB

  • Sample

    240615-n5gjqstdmp

  • MD5

    63a945da1a63a8e56e8220c4ccf7fd0c

  • SHA1

    a99cf1a2426edeac97c789d0a4b7d38606d7aa45

  • SHA256

    ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

  • SHA512

    34006d84587ea90e243ebe0dd6bde8bd502ed688001a412898cd4e4c16a5de5788a9fa4c53d3ea79e4307adaa74496e05b205bf9717ac833db976551b1a7c89c

  • SSDEEP

    1536:ikB/Ih3+7QuoZVQgf5GV2jSzGpAyZ4ICS4AwnfxnuLdSbSmoNUExd9M4dgS:gFW7gSzKDin5nWhw4dgS

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$BllCF1wpSZtPkRTz1ibVTuYtOj1obpokRVBBYVM/plW9vdYxxgpqi

Campaign

4166

Decoy

creative-waves.co.uk

apolomarcas.com

dezatec.es

jorgobe.at

consultaractadenacimiento.com

houseofplus.com

goodgirlrecovery.com

slimidealherbal.com

allamatberedare.se

radaradvies.nl

smithmediastrategies.com

ahouseforlease.com

plastidip.com.ar

sloverse.com

simplyblessedbykeepingitreal.com

mastertechengineering.com

planchaavapor.net

danielblum.info

4youbeautysalon.com

marchand-sloboda.com

Attributes
  • net

    true

  • pid

    $2a$10$BllCF1wpSZtPkRTz1ibVTuYtOj1obpokRVBBYVM/plW9vdYxxgpqi

  • prc

    excel

    mspub

    firefox

    visio

    ocautoupds

    onenote

    synctime

    wordpad

    outlook

    sqbcoreservice

    mydesktopqos

    isqlplussvc

    mydesktopservice

    steam

    thunderbird

    thebat

    dbeng50

    ocssd

    ocomm

    dbsnmp

    oracle

    msaccess

    agntsvc

    tbirdconfig

    winword

    powerpnt

    xfssvccon

    encsvc

    sql

    infopath

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions The final price depends on how fast you write to us. We also have gathered your sensitive data. We would share it in case you refuse to pay.

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4166

  • svc

    mepocs

    backup

    veeam

    sql

    vss

    memtas

    sophos

    svc$

Extracted

Path

C:\Users\pj328zw1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension pj328zw1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/881AF8D02A6585AE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/881AF8D02A6585AE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: P58HocFcL5wyWYov4mRqXGXpxKFdz+xYKJuApYSBVc25/ROE6RCnEsJ8ID12nRrS Z9orJyTR6maEDn1eNqxJ7T/Cy5HwJZ7u66nPLwrNgSu/WCYzrZ6uywEGsJKAFR4E 0+kMfG4NDO0leecS75pCX0t7qXpZ5g3Y5zUSYuh50QQuv/QxQuImBfmuIxtAEtCD 30zP+0dv3Q48RVkxkqoBEIUhm9v5RrxzjrU8Pk0A7LQP46fQwQ3kiwtjgzAqJydQ 4kf4X0hdj2+0ga3/P5f15uVz3NSA+ax25BX101OlhkYnJGg3t01o+frOsPyrdj7Z L2ATTEUpzBxRZumXfVkJbscqHABv18hhI6WqHlNdzLs+XauBxEgs0gxHAz1HFyAw rj+cS57bkQ6E20f0Wb0WVYh8Gk3+CiCGNgirPPykcvzwgQdxH+BOFFWG7n4YWkMY gfkDO/V0223K13WAKDVVVm795FKrTAhX3j1jlmYsVOoYTK9j8p925aRhrmMMQYo+ fPEbu64T37jHt6BpGfvurEwCnAs0qtqv5nvjxRTpUSn53S3ATZxu12g5CzfXvq19 +I5g/89aLQ1jS9EdDsmQAZVOoJDOfy2zkcWf37S1WFSBwJy5e7JC2bZN2Wg41GUU fndeL9r/wQPyw3FYO5wbLr5a3eLq8TREleHMK0hS4GGfXzOTGv/Db6WzfKKxzo+u CrPFiiNVQisGjVW5vJSVZ12zrO8dS6kS7nhQYz7YUcnjESA5MRkClY+61xU2Nx9+ PJ63CTCH2S89TCgQdkxngW4p7Bt9slfUcs7BuFG/3k2zBwr0xirn5DDwDx+ogofK fQ5C78UToQgjCe/rjn891N2bA+iWSI1+3RoQnEoaarZwCu+0YkbegVIBu/9zJ3cl EZQQg0rTiv33vddL8dB5PA8DY3QqefZCtNewtiqjGpQDhg8OszZDWZgSxBfG6F9/ EsoxiFtjqskHvWb+jwERlctQQLYrkdObF8kQngBijB0hKLK+w+05V6QVf7dqCiUK sWrtls6O6WD4Q0UvxU/C9kQJuMTyVP0dLHLqIRGh7NyIDUtIarZZMWFrVTTuxHTg XUKGjMzIWNGJhhM7VTHM35lqriAP1LnEU+mO/i9LEXsksgzNaSH2iMjX6rUV18Vy ucTM5+NW5FiaF1CtPPqjO2arnbKB9A56/mGguTI1sxfMVkdKQ8z8bQ9SIYKI/iA1 jRvQ4lJzfFgB39vgdSVQEQ0s5ut8EempcqyTlf0mPasV2PCxru2VeG267MofTcFR haua2TKKZVFb+GaZGXPpOtkAPvGchRFURe95j1KaUXNYrbXAblLeRR0o95X08Hdw 33QEykuhp/xoJlj9ob7mQmT2zSQD/L4NW2d/yj0o77WEWdW3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/881AF8D02A6585AE

http://decryptor.cc/881AF8D02A6585AE

Extracted

Path

C:\Users\93z2w2j3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 93z2w2j3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0846C4A22137B9D5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0846C4A22137B9D5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ceL4M+s0tdpXTe65H075vuwqhPHwOi6vDcRWgkTA7VP4cLdMTb+SKVOT4H6zjmkC BErU4pka6T6nA/ZHoucAwS9I6xaR8kttAt3P74eMte3OCpoqUUofybZFwYN0yI0u yQi8/zLSYkjNSy0ZjppYIqBxTNQsLIbIg9Gi9HrY2ykk28IHUFcRuHIBWGBvKcsZ Gbx23BFJ9VOfDya/yhafzfvePvmfJbCp7h01gCVnsVv7eENqU7X/Sh3/XFCfctBW Gz5NEigZdDS4pC5M33mQ89HD3/tK77s/CGLoFkJWGnM2MqXfLnAH5fyt2kfIci1k DkbvM1oW5oJeLdIePZC/N5Wal7P2VkRNh8s/SZo1o89b32h616vd4ckm7aoThSp9 juiBZm4NiqDtiDk5DVozJWQ38ZyeK4Es5UEwew7hG1teBXuMdAMYahkfLukc2YRK NJduezd7uAO/BZ9emMmCG5mSGdVtrQXmxIGYgreJ0SKW7HQ+Cr9pJwEQvn4QBvwH g2qzstcRU6eF/ASEoMbOUYrVUhIsMt2vDPw9/5E8D+XY65lRQV2dfi60TIfcsZCu AJPxNyXM7OWb2Oo7fjstMcQDSvDggyM92PB//EHZC29sAkvHYyBuUtXHfz4pEMnO 3rgjQzZg2IY3U1ncwT0StieV0F4ML3yKU7enTmtaoW2UIrlKOldtuLDoHr88hR7m P6u39jOZJhPRw1pIMULVfsH1jj/OvBiyPpW/cLTJ3KpRPAG87QBHu8O4UECZ33Ls 322lW/sIORfyJPh48w7HIqL163zQ4KUAphqE3TcpBz0CPtAa/sOXGUhdAtI4sGoX WtH2gOw3g5Zp+jJjf+6/h7wI3QU4QCFmHnr3NvUlVUf6WXCIso/2GWsu6UnmTORs APVlfUXT8bo4lpT7flGAoeiRdWh8EsI4J+BXbdAqFc31ZUBwXoWygX7ssHGBZTyM ivR10n34ovdZEBe2kzOr+E3T3Ru+IGiNviHmbLl5X6FgEMS+Ukk5Aia3kxbrK6o2 BcruwPX3gUFGnW4BVL3iBzvdFUOlrWH9tWKxN16Jg1Lq9OwF0iCN/BSXQhI0/1Zq l4JKW/exmwSE+6NUccG2+IfVrLPpYis/zWJlL8nWvsURJr1Bo00zhI0EwYzG3Xnr aHacZ8s2LuYj5KbeZE8Vtzw2qRphHFvePD5xfsGxKe5lt+QKoGlmIdRkbGW5Bwqu licWN6WQp62dROTqlkqgIhBIauseKcYjYyHa6YM22iWpk4OJc41bspX5o5lucN0d FcnEKr5xtiQQXVki8wbxXmjQ+9OEGW8vYmWVeVvfq8DIcmeZAGAwJ9Zg72Vk4i44 BsctSbJZeCKHjQWLCkcffa+GHHE9+3lWWpatwQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0846C4A22137B9D5

http://decryptor.cc/0846C4A22137B9D5

Extracted

Path

C:\Users\swffdjo9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension swffdjo9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/98B7F72715337990 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/98B7F72715337990 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: THVb9zYTY57nKUTpGGU9boBrXQI35ximAUMtDowhX2Y46nSvCkNrcng25xpJhedn 9Higv1HOErp31KMFMWsLnpYyw8OaSTuL3LQ1fhWLFHVz2BLf/w94Z2H+xqOGJPxJ AEQCy3KsNd8TPPs4WaMEUDxcpk62evFh2L5tIXIz354c9Ao4dWIb2hHLF87IlL7c 6y3AT0+0eIwMn2wjefsP51ZjRPwq/mdZBuILSKbPR2Xo79XUlnZROsiOtVN5ifyW 160bIaPn4xSUSA0fx7+v+l3D+/lw54UL2Hc4IQg7kuXZiiDqYpaJ/8IPOxq0E8tI W3j4hRT5QIzCVAQ/3+bhRn+bolG0LyrnsNNCSW4n6o5yzlxZqNCMcV8dwBbxBpUr yfh0839EuDfiCjbxmBybGhLF9SaUQV8ei023gW8+1jHsiKpgpvKQt5FQvGN+Zley +fdIiaxGZAzKeoHJsS6oW5OUr4hzpTVoZNrAyASWgm4w7wjr8ZR46j7hmGkK7jLd XbJkauGEZfNrC6GSEhvWJBtminFo4RvMZ8gBByzq2DQfk3hen0phfUk+4vz4jlKA zO3A2ToaMDTz+DDHyAXW5ptvKQZIzy4sZE8sdhLysZ77Q5TFd/LwwocSN33+c03N jkNO+omuoUjdBVHHo/3S1lP8tYIowJmoxN3QZga8bT3k4884yWnQZV87OKDENcru eIKNemNRTJGMcY4rZXKadkUNkF43z6ynRAUv+kLQ573tlzlRrcjDTSPFfIm1kZl3 9E05f+8Kd88PuQ5+MZ37ynkrl5ccfVGgPfqEtMTJ3Lq/dzImINsTIKhCeIXzfjae i5jDGo9MWpdS3MRL7SVhC8zkKr2rd3t/mW4ttdu7HkGolrbaL+7ibgeYjA0Cn705 Cu8C+dHONYCEA01P2BkayRI/3VQ6D0uKrRNXK8GzsTe+5XrvJUcDhpbGpDn+MwRA 6hfU4lfn3VE9VnAFvGquWRnD2f/5j42gY+37ZdtgBAB6XA9ycmfoWctTPZQifNKR e7ySymyGDqewPztU4m50ed1QR86qPaMFuBT2xyUk7dC/ovpoSmcM8RUJxh1wPPLH h+7Krtm28fL/vUZIAD/IpN7nqNdBhwEWzNGCnezu4/bKpsde+acckFfhdiXi6gD2 zulxCAXhDzP8eUocPNYqJOVWA8VgQDVA0FmaasXBeomk6IbH3PNc/RgwWnI/ZsDf 9lF95QfHvXuQ9LXkl9CPBDnyz27RD4z7Ni4iLJ6sQqFA/VW9UG55qrCWjWpWYrmT Lxw7iz1Dd8FAzsUr6tVxhvhl5w2kTfbmOcYv3By1/jaNoQVbwMhOEZb7/EK8kXK8 mb+Z6Z9tTOb8Aj6RzBCqnBHm5Tk5dIdWpM9KOpo/0sC76KyCcnOnm5US ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/98B7F72715337990

http://decryptor.cc/98B7F72715337990

Extracted

Path

C:\Users\of009-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension of009. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F8E70BCCD1AA0F03 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F8E70BCCD1AA0F03 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mUyn9QWesrJqME1P7JDRLSkW1aje/wl0hUTVWpxwVoW9FmsbB/x1/3nu2QbV/IVv pZLCXU8cay31asnnygjhuBpACnx+VNKpsWS127qFwRCAx5X/Opp4d4HFVhLuKEXc hwgsACt3jyZrQa5rgCR3OThRNnMFXOIhuISJ+JPpC5vAmqfznNDglr9ORTN9S6de EvE/SKsJ/jdHf6X0mH+BaNs1p4HCdpUEkiuYRBrzXIcy1nbadnixnF6psungPd6S yJPnsL1iqwfL8/ENAGDLNtFmmjZdp6TeaQ81j2WEUO4gzt+rt59giaym6KkEU3SW UBeNSo7/CeKkCMvgFkhY2bwmHGY4e5vf68+cQAlNJnGdq21tSFCCrWg3bbmMXKtU Kx7s9Uy2xiWGAykr/OqSjHYECtd7zxrLjXRL0IC6w3Jzn6JACx2thP+3mYdvojm/ rubA05I0heVuMJql9mQoGPz7QjZcvMbgKjiamo4QajiRdvYmUI8s3SWuhoH0Himq 13a4W7kFlD23Vf11aP2+7QzqJudcdP3hjzuS1h3uwWM7S/yCdpxeDxzGkfTZA/me 4BuyMjcdj0LbXDQURVZySLTQDpHo4gU0JnrNMSNE1ZhEfGHTjeFWeR5u2+6STbzz rsvwWA8wJpd56qw0KmQBSFdRkAV59X7Q1Qkeu6L8X6i9Es9PLpH9sWUqakPyZatb s6+4V7Oet1tM8chTtVXxH30aQVy55UnFoyRnrdQToHFoApGa7b8z4Goh7k0/XYNP v0YOtAu+7L7ZBRHA9Dwi45L9zEHouucL2RIrm2dVwq2s5iPHz3ezJ7JwoY00W22D HAUDoe25VdeLUU7nVBCxpzX3RRU8RNvNAPY+V8MeBjzSABaEuAHW0nlAKt8UXGzL HyK76MYyID1pqzVaDufFvwuMI/ta8ntZjUfFYzeZKAaEXbBJ78r/OHqfCXiHesR+ 50mwbzuhAcmOcTMwp9hj9XVCyBACYsvheNRX+/JanQ11ucCTBWvj/Aao6/DWWzI0 784DpZ+pnb524+CWxYB8i+MAJhU0r206h06LXMTyKiQ1+dOHq1WweNfxeK+oklWQ cN2jTimKM7Y4b7kTOAo657C24zC/sIiOfatrbxJK/OgGIKJ8EIjtUM460lreBvb2 QP522bwlETa4AHX8Uf+TjmexprujkLmrJplwnIgYAcy0K+rcsWnpWRAbYNsx8Kyc 1cRn6n9gMrj8JoGQ/+NWb2h+W938+bzB8z4CXs1lL3mTg1eQZaibo24oAyr0wmNF mYX+fQZMKf/e6XuaPfl4/UTuTXhegDRXwDGrSiQ5yY79d/+UOdGk524QjYlaHXwi /7veBaVG7ZsbdEBFfXoYaBbhzi6a0zDpAl1JuuQyeUIB4F/V ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F8E70BCCD1AA0F03

http://decryptor.cc/F8E70BCCD1AA0F03

Targets

    • Target

      ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

    • Size

      115KB

    • MD5

      63a945da1a63a8e56e8220c4ccf7fd0c

    • SHA1

      a99cf1a2426edeac97c789d0a4b7d38606d7aa45

    • SHA256

      ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

    • SHA512

      34006d84587ea90e243ebe0dd6bde8bd502ed688001a412898cd4e4c16a5de5788a9fa4c53d3ea79e4307adaa74496e05b205bf9717ac833db976551b1a7c89c

    • SSDEEP

      1536:ikB/Ih3+7QuoZVQgf5GV2jSzGpAyZ4ICS4AwnfxnuLdSbSmoNUExd9M4dgS:gFW7gSzKDin5nWhw4dgS

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks