General
- Target ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae.exe
- Size 139KB
- Sample240728-tsfdsssbpr
- SHA256 ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae
Malware Config
Extracted
-
sodinokibi
-
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
4085
-
sandd.nl
-
digivod.de
-
southeasternacademyofprosthodontics.org
-
resortmtn.com
-
mdk-mediadesign.de
-
tetinfo.in
-
fayrecreations.com
-
ecpmedia.vn
-
physiofischer.de
-
highlinesouthasc.com
-
antenanavi.com
-
blog.solutionsarchitect.guru
-
deepsouthclothingcompany.com
-
coursio.com
-
quickyfunds.com
-
atmos-show.com
-
pawsuppetlovers.com
-
hokagestore.com
-
midmohandyman.com
-
mmgdouai.fr
-
net
true
-
pid
$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.
-
prc
sqbcoreservice
dbsnmp
mydesktopservice
outlook
ocomm
excel
mydesktopqos
isqlplussvc
onenote
tbirdconfig
msaccess
encsvc
infopath
steam
thebat
agntsvc
sql
visio
wordpad
winword
dbeng50
powerpnt
firefox
xfssvccon
mspub
oracle
thunderbird
ocssd
synctime
ocautoupds
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4085
-
svc
memtas
mepocs
backup
sophos
sql
svc$
veeam
vss
Extracted
-
C:\Users\n9d25smb00-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension n9d25smb00. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECFF06A7153931AB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/ECFF06A7153931AB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JbbD1HQSjTK1Ki+hX6G8QUm4AuvFuhf9UwXUKYLVVaCzOckZH7UHfvFExgI3A7/H kNaCUUj9YMKbMpYpMCVKX6syEW+VIQW9GFDA5qXxVLzmLZ3vCv1gPbxoMwK5FUmC 7iVOR62uAJrPssFPHtf5ri9P2Jyzf6hbAz86NW/A1HQhWlROzNitIu+7O/WOmfTZ 6x307SU43Dpl2Y7FYy15BzkhoOdU2WKuV/ibNo/xlmT4kiTCtp46J5HBGbgsHz1A EnSyMI+eaz6kKpQH8eU8GNX5MCcvwEK+8tuJp7ouPFYFmlALjRXCbNOadOlccuvO U0WuaXQOi80ZWXpR0hB/5Ps6t/Bn5FomhHk590evzqcAvXjwrjUJl+TIIRA8pTB2 O0ZKwhY2bNNoiU8oNAqCO2Q/CUlY3o9vmYq3dEyDf9cK+LtpdvG6pDcXLF3LwzIh GsfZr/lmkJ8IQjdDitislWeR8ntugW0NqKvF1wW+/pc9zFb8xRF74o8X0K/KWdta pXx3PQfX27FV2bwRhb3bd4UAvd3KiGFD38TFoNXr0xaLNWc4qkkR5lYhPItnFvgl SsJJAIwau3WMJwLtV67mwT92kfG/Kaer1yu7lNaPTdU4O6e+ehH7O2S1FbtFHCHV ViyR3pYgLjxOujaFfBlfAR109YN2mjlInmlAbuFefVFQ8tV5g2jOMa8RmS2MFcrz K7W5ywp6yzruXKkt4zFRtFjQX1Ezf4sANpGp+tluxER9uq37apXaEgSoKUiWT/PZ eXpFl56G9wqYyM8aUNzzCfp4SPpc9lJ2QdK9RLJrVd3nMUDx+jtI2B2ZigyS94st PiiqUy4V5+zGxoxLZDBKUniliei+EGFGCx/drks3aznOHPGiCSgQGtFYbsrvfz0M /vW0refSa94JMGyywuxIFNl7RkruZYYCWoHOGiw1wL59U8C+g43YQZG5LqmInjSN sXnuvvg8w9SM4JHZ7eSgQ6YxiXO/SLXvSpkEGZjKMQRwjdV6q/nsYmSoTTGslv5w lve1Czn8SBJYWUEF0gtf+mPt1X34L/yoDqZUf7OIkVY2LoHtfXzj6RXzL4t86uVo yOpwqRezTbZkndi/lM7y9R4T/xjGKjuV3EUAU+rVXqImxlcd+r0LNX6X6JODQ/62 kcTqpzF6uJIwN0NHML/54Tj3t7o72yimVWGGM4Q+k74yrioszDG8CzvVuQMphOuH nZolTW5Uy8324KG/SJnWLnUuRLro6b1RC+JwI1kgaE6eBcdMY2QKC4HHdQN0cajM nE2zRiKbxaXIWBJrJW4W+PTlAEMaQ0SLtFxJGQ+2V1OYQcvQ6ewyFxctIQPqrQYc hY8UEhSJMLqSgI6gtk1kqd4TizvX1aiD2UJ0DahxzFJZi0tmlC2BEg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECFF06A7153931AB
-
http://decryptor.cc/ECFF06A7153931AB
Extracted
-
C:\Users\atu74c5-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension atu74c5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/036A99092E54CAF7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/036A99092E54CAF7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 78Kymi4l4s39hd+MUUwRUKkeUJaSvoJABQYvQmoAsA8UUB92ujQcntxAB40SkEKY ZHIGZZExUvqYnUNs4+vLWV5nItkCnuXc3ei67sCC3SEtL6H1M/YbsfsizmLsh1S6 cdMnpMLBNvxMRn48GMtgiK/K6SbC2XuC3gZbZ6mvrUkFtbvZpWfcaYQI1x4+TidR Tt23QMYSfs4Wi71c8QA2jbTT79GauyN1u0pyv6RyzS6nEx+WFvX3Ooj2jZuVd6K4 5poWR4odBPubiFPkLQ7JjvIRv8jcjiO++rakMY6bQWCnenDC/RPLYpTERMAjr9KZ tqY3Sev+TzGGR2qxsm77mOAdE+oTSFGC0YDmC9v9h0G9dmaShYzCvRSnZFbk+9o/ 6s/1u4jK6Bt5ZKOWLo0dTX4OImMiy6z9AKRk5bj+vQJSmdL3L7gMl/cBtjxJ65rG dMZWAh66qKFHxucAd/6wvC7nWVm7l+ZoBC1BMqYxb3qXFzbrLlsxyJonCNdNqot6 /l9O5uRtBTwBFwnv7/+4WJ9alX7AM4asWrET5fFu8cIQUSIZUudc4U38VOp+u8xR QAfTt51oE6wWCe4JpV73/etbuS2HBy6pNceEq6aCeO+eGMMb72MQjC2lbYvTfXwb nHtIuwb0REIV7M8AfbLZFov2dsvb6r9EYnzG1PwTO47SVKFfWYM3UdfirrG9qZ+x HmblfICCwdWDRq/YmovWFI4DE2PAgr/E/Uz6n0D9H5EbM/YSPhkY2UQUZumXdeLN mkc26UIJ9QsebCeaRJq0gHnHb1EAHAQlsmO8Ehw8MfI5+ZE+0xZHwPUvxJ6D601s 2Rn6nhIL+G7xOB+IdhO1w8aNSihya4s8aT83Q0rLwbXCJxl/jvREKBbuMEP59Dw5 aR/hEnzcbYNsV7NvxMD6/iKZE3xok/9XYCY4a/poNBKo8sPx+vfPtbUGstL3Nh07 kRaESWzkFO2S3hwMoWVmgm0JtTCK+ImRVpAI2v3WvvfA+09hrZF/MbEnhFDirYFY ySRKxLTxLRpJSe/8vQN2E+jCQ0zx/7qEkzMH/aQfeHs9MTEkQdm9bKpG9OkX0skQ goyoWcl1U9K2ag/k7vS+Ltv+sGMDfzgy79nw4x6tWPTDhv3bnTWYUa30Vh/+D4iK 853ccogv++6gfqE3ahjIyqr2aZBYbj8syT166TIef4fOoaGDjeeNcPIkg0k3El6z xeIZVgEsi0gm7kvC842+qMNF39KIFwB2uVZTukPF/KMpzip73ehmX4PCT4LQa2uy i4U4SYesS9528Qlgrs8kldGnylZSVKsf92UJ4+LfnLhzhVM6Bc2tCYLowycneNU/ m1Oax6xx6bueDaeq66J75LiyrV0SRqoO4CcPRfnK1rvZNe+ijg+zNA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/036A99092E54CAF7
-
http://decryptor.cc/036A99092E54CAF7
Targets
-
- Target ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae.exe
- Size 139KB
- SHA256 ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
ASPack v2.12-2.42
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry