General

  • Target

    2024-08-31_75782eddce812a43f50647c717392b3b_revil_sodinokibi

  • Size

    157KB

  • Sample

    240831-vz2q2swdrn

  • MD5

    75782eddce812a43f50647c717392b3b

  • SHA1

    0913c78ec2b2dbc14d42f91b590f87d58f188c7f

  • SHA256

    1639475293a4d7f82bc5e218637ef5fd43d5163657384ec96fe63e78a19a8203

  • SHA512

    d85eddbddd0094fcfc251be398f5b20a97056d381f2100fdfa140cab45ba20c63b1abe984f0a4d29eb68a265bc21645a7e9d95189855d4b7dd66f1e19e4c464c

  • SSDEEP

    1536:L+bolsa+dSn91zyKRpK63R7Pbi4eTMluxtXDCntTnICS4AhburoHDycTgSAIc026:4do1zyKzVLbi4eTMlwDCnuusjeopL

Malware Config

Extracted

Path

C:\Users\Default\8tq15xrc99-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 8tq15xrc99. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/961EE5448960D5A2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/961EE5448960D5A2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7qTYzFuhZn4D+D5FOorB6COM451Tvw+t3EYVJikCSBccH+h8KMADKmKPMFcJ7A+C YvO/0ZtTWlB8n+xcm1QkwbMD92BsgWr8ptxeX1uR4HbrHLCJMDa++gEUXJ18SRkI mCkAgCMCmU+VbtaKRiJGuNcjK/ktL4+4+0yXWvNQumvQwTt/i9R0dvy8uD3LAet0 MzBYWkoZMM4yoDDi6maP/lZxcjSSz1otmNoTf7nX0J04Pi4Y9FVQgK5yyXgGSYsQ ooF0MojoMdH+R9oZIbtUkOmeTzNgGWbn7tyWuOW9aVm24kiYFygxIgCqNCHzQUu6 xXXWIW+0z810qOw77lDuRYqadJzwMAwO1/gpsSQprbUeXAC6nhOe0cBj3DCA60pZ gV6NETP/LnRe5tibhHf9AwQDmErgHpEqGlItCwYE8WDYShXp77zy+hi5xF2WBtNK J05T16qKB0H/WGPpMdpIauw1Ciwruo8uvOGnigv8SMpVBHNk/m1UhCClCRyEXhxd d3WMfSnE9gRXSmToOyqw9Kki+HgWYFHJWn7J/C1v0hYcxKFUdrJv2jerAHzqVRXH f4Rez2saedrM2jFPU4dVo1rs4F5skK66EZ0uZmL5zf+DwBcPHkztbRE3PyWoj0Iy ByQL8WEJ64+pOBLVV0giYxbtmFbK+SH1hToy4Bjy5rGqEmoyyqqN01mayW641aL8 t8GSHss3IQFF5FcukrSYFX6ftmE37UDpGzeLNuGn5Kjy6vDdpSBi5cAv7Gvdrr9r L8uIsyMyjGH8xvoq3Gdz3az4VfhNJJ031SJR+ITPo7iA7J7kJ6ZbplcESmhXeK23 6uUTqXw+bLhszvqXC39B0Wz1YkABlI4Mvp1WFxQIZ3ZJM/qUrBIGYNUv2dGnLeCF sXIwB6Pjb8oGEK2tO1687pH82vwEop+bId4p33DiWUnQcLAoA7cMf6/+9dddKcln l0x/6BCrmPUqUNLjKLmia2wg0QIu+UzWlSVpEeemnLBJ6aGncKiyU9QHiu9KSPj4 gt7S12mV3BhwdhWcAnQDON+C+gMtqBPwfWEUGDL4Fex280fX4v9+RffKbhWdm+Dl PKdJQ9FYxMpO30ewkgx6DjrBvPglJMjmapRz1pBXEJm9cdgil8rRiWHErgPjaVW1 iPuuD3txhKbvUOprN/7uxcF2PDy8Bgwj Extension name: 8tq15xrc99 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/961EE5448960D5A2

http://decryptor.top/961EE5448960D5A2

Extracted

Path

C:\Users\Default\gqez7x94-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion gqez7x94. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A9732B6313D4685 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/5A9732B6313D4685 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gFBpv3moJGsxMKtg5u+aU4RTkJXfvFPHYyYOUYyOt378l7z/gnNeKHOMxT6FD19n GVFmhAr8wzUBRxN2LOzWhl5tjV2BHZt00a3TgavN1U/lN4QlhgcVigBmGzxKIMhD fpvMw1rgAVbHoWcVu5Ifrf99+UtP57qXI8DQveaddQaBIHYAwA4awtsbD6CROZmX grf1raPyLhQGTjmUgm6B+8oe2VtH6jRxoZG02nogZXtrm0mwtRyaBBMyu9NlkcC3 4QNQjUjsvsGr4olN2mSl6xzd8Ykjh0uS5BDUZZLqkXKjTPADtFIOGprXU0qmGm+A wQ1K+jrtcYLM11OifOO6TbzE/TB1v7ZtMfCuK0ILtfRctff2WupNFgxj9f6mvYxl pRoaPW5TiM0bD/EQ1CnO9F2FIQLTOoLfyVd+9eW7iTnKxStPSF6Ks9kFnoWGVloh T9eK4ygpNldYq8AIBoouj039JNO41FwV1oYeKutfGTdjpc/5h9MvZ29Jiba6SthB zWdV6eKLdTRr50CfhOv3EMnfojEbyxSVSbQvP44kyQwvyiEN15seWZ/FUG3/D2dV AjkfdFgeu2C5D2Z4pw+PxiG5x0kyCSyJoPi4S67pvKg+rDy3bIyM1dWF+hrjyPjw 0GuXl0y05zM6rj+FztfnjUGniV3yGSVHBPCNzlmzp5/pfq1sXJlxaJlJeS0x1uEl PnhcdWsiPKJwT7tueylpMIrsYnhf8SJwKOujMwIkCue2xJfXGbRBwzLtGHLfs7vI PTHRtqCJ77CxKG/XeL1IPdaW2ZK+yDY8+HrI9PJyITJbXbn5Ewsi+RTykwLJ8bgv +CHwyaaMZgBLKF3DEqmNd0pf82otgpS32EBZU+kr0W1b9VO4BHK9EImzv/YWCGMD 72j0sIXZmI+jxE9zdu6RGCkfB2uloC8a6Bn12YAaF5limDwS3DbE2XpBoC0lxyQk 0vTn88NEfbbxzZcJlmVn9bmvt8IasQm49NiWaTjenFk3rSN4j8AtfKbEv+4EhdXY Osy5e7EKq9Pkfo5LQOtAXOdBTtrZKxY0oFhJU6ULqymvJzxsF4QXglvqEQ6XfssO 9yKXqdp2gvh6h7csTGDHTDEY1ngUcth2hJ4svL5IEtfntKfXNEyUcksVofQ/Lbeh 4mpnTGOG22CMFohptOInKbwD+OjsD/DsN+TmPTU/ Extension name: gqez7x94 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A9732B6313D4685

http://decryptor.top/5A9732B6313D4685

Targets

    • Target

      2024-08-31_75782eddce812a43f50647c717392b3b_revil_sodinokibi

    • Size

      157KB

    • MD5

      75782eddce812a43f50647c717392b3b

    • SHA1

      0913c78ec2b2dbc14d42f91b590f87d58f188c7f

    • SHA256

      1639475293a4d7f82bc5e218637ef5fd43d5163657384ec96fe63e78a19a8203

    • SHA512

      d85eddbddd0094fcfc251be398f5b20a97056d381f2100fdfa140cab45ba20c63b1abe984f0a4d29eb68a265bc21645a7e9d95189855d4b7dd66f1e19e4c464c

    • SSDEEP

      1536:L+bolsa+dSn91zyKRpK63R7Pbi4eTMluxtXDCntTnICS4AhburoHDycTgSAIc026:4do1zyKzVLbi4eTMlwDCnuusjeopL

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (200) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks