Resubmissions
23/09/2026, 16:58
260923-vg6bhsfg531006/09/2026, 16:14
260906-tp1kkawtev1005/09/2026, 18:17
260905-ww6fhagk9y1005/09/2026, 18:17
260905-ww55qsgk9w14/08/2026, 18:05
260814-wn795abb231025/05/2026, 01:59
260525-ceefxaat4n1001/05/2026, 12:22
260501-pj17pabt5j1021/04/2026, 16:21
260421-ttqadsht2l1021/04/2026, 16:07
260421-tk2xtscx711019/04/2026, 20:34
260419-zcnccsey4s10General
- Target v2.bin(1).zip
- Size 73KB
- Sample241126-28wpqa1ndp
- SHA256 f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554
Malware Config
Extracted
-
sodinokibi
-
$2a$12$lTqvWf.cQvh9W5jZkAk9LO0hMLnifWtUFoBJ86Ge.hLZGVClg6xhW
-
7563
-
commercialboatbuilding.com
-
parkstreetauto.net
-
longislandelderlaw.com
-
lbcframingelectrical.com
-
assurancesalextrespaille.fr
-
smale-opticiens.nl
-
naturavetal.hr
-
global-kids.info
-
kaotikkustomz.com
-
klusbeter.nl
-
socstrp.org
-
stefanpasch.me
-
jandaonline.com
-
beyondmarcomdotcom.wordpress.com
-
nmiec.com
-
sabel-bf.com
-
edv-live.de
-
zewatchers.com
-
controldekk.com
-
berlin-bamboo-bikes.org
-
net
true
-
pid
$2a$12$lTqvWf.cQvh9W5jZkAk9LO0hMLnifWtUFoBJ86Ge.hLZGVClg6xhW
-
prc
oracle
excel
ocomm
onenote
mspub
powerpnt
synctime
agntsvc
dbeng50
isqlplussvc
firefox
mydesktopservice
steam
winword
dbsnmp
ocautoupds
thunderbird
sqbcoreservice
ocssd
encsvc
xfssvccon
tbirdconfig
wordpad
infopath
visio
outlook
msaccess
sql
mydesktopqos
thebat
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7563
-
svc
veeam
svc$
memtas
sophos
sql
vss
backup
mepocs
Extracted
-
C:\Recovery\9ji5w-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9ji5w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C5255B4EE92C0173 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C5255B4EE92C0173 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: x1taL+jGbUpeHckYauTI1R9ge1rUwcE4I0AhMjw4mfc8jJjGm0G0t9hoDNLU8EQ7 hzP5p5GZzqsgFEtYdRGMjJ/rtPCSjduimCedaEHnXYADKvteKUXiRRecJ34Jxt0A tPE/GOzrd0yOPckEYRWDoRdwdjUqahxsRF4IUL9Ih2o5ZkwEUfHfyhlO70nfovPP Oyehloetk1DZ5wDGXLSTvOovLtp+i3a+MPT6qeAYJ5vLvN40nCf6hRbFdxbGzHIA XV5qKrvPAUZP+zDQpC/2djrX3H3tKEvthwhP4Edwo6wKsjBSSVAvvU6nsJyG70P6 Scb49t2LKI9Mh0nS0+taO1yUc2Jw2htgl1Q0Ht/8cjrD/FkLNkX2QE7OohACKnZJ 9p3Jna3x/K2mqJVimAR/FrdKvJmpsDRERd/WfEgnSfToiaocBDYtifb4vqCT3MVU +p4e/IZubhFcIM022cEqRYvNsLw7t4eA2dltzv0MmM5o7mSjamORLMk8cQF2ll/G SQa+j7D5r0tWYwZpvhERu8uc7I7mAHryMGCYkQZlzEnVnPt6gJaVrVqs278FjJm7 kb+xSd9CFduJGWre2wntzn6ypQAat7FEEEXSCUPokRQo8ItOqyhbaCvRIEhfPkxt mtg9i5wkatRbPpNRg+ra5Ht7cQORfuExWeKnk77qARqR6cEIJPBrFpuCYMPEImPH BU+Hj8pmH+8ieJNw8M2vUrv7e3MVHl4pyCcgrJhJvowd9ettnszFlXZ/0nZN76yQ NZPXn2RBppDEeVDSHKlhT2WnXT8YLLCUYv5MXNR0Jbh4Y2/mTnD6t211Z1LkDAuz pfKcsehar5OB7U+HAe3WIHIrytlhX/H1awNmPfFO0/KLBoJG1G7ufO3vMsa4jBM+ ssIDfn/ahJin54dlc+dEhcOpopS88/RCk730Xxs3Bf02OAhhpSuOe3dqVIC6GMto YoriViVcsSBv5F/sPNiAvvwET58iA10scWTXIAN/uI5wNPbb71CexRIdYog39rFn 6XIFZOF00MuYvkbhZOcCGYFH+rreRTeB6uGN0YllIqgSSmj6+nDOY1X75+o8zPTZ N3WtvzmBn25Ct88TqiWeRagG9piBVGafjK0DtK4ww400T2SllEnsaEo9PzQdrAiU UB7zXwQ1HgSRrzjcg3Sx8D6oY1qbB/+rZCB0rZCcxcAZCg1o2UoWWLeMMNAcH2+3 KNvJEX7oA3akjZ4Mn/nL/IxmqrS4X4LqcLZb0maSeQKHRkqENHvcT2AfZRjgNAMe NbPGARb63obfat+7fBZkDwqenNsQd9TrBV4llWMXb5ynt/+rlwJBsT+W4wsBnI4r 1zBAD94CsbKx6tiN+p9ZC7wUkI0= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C5255B4EE92C0173
-
http://decoder.re/C5255B4EE92C0173
Extracted
-
C:\Recovery\95xgoqp7-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 95xgoqp7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4F49254CB79C126A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/4F49254CB79C126A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: I5WX35t7wLzcWXiWbjB3GTSdGK9dQWoWyqRF4zd3mLfFzaCSqPuAcoC6doURbPmU IEvOSJady3PfwaLOxGKupT7ldm9KnugQ0dDxWjOEfgLajIENMp3nQY5yhySqKVFS 5vvpKz9mjqFXdD9jel7/suNUaj7Vg+GUlLo/oqli+2zdUwMz/3WAoEtZ8i83/XZi QegEv+n35nefOSgDWf8BKCzj2rKpFnqZSuDdrwPFfqJ7ZbquuvgKMdORj3WtnV/6 DJ7ca/W3vRswabDddo3T3mJ3/QQBkVTz5dPpCxWlOUDdZ/pALT1yaNerxrrKRk9i FfuxjwV0bxcutzQYaONQWoPX6LMh3iEU65wHkYtbMQzDhEYQfMcEOVkioP/JV5IG qTnp9zaoLfONSamCt3BdCBFzgmLf0b2SOoGfDMypjXcONbfAr4nPdV11ojoGIUY1 IjFBQ81AAbMXP97ppoNz6QUDc1YxMwPuq1cbMREipJHFKZWhKYPStYzS6rkatpqO 3ujJGuP8gTuMd+pzpaF50opDvAvBzzqgOXbgb/a32x1PbkY+Gv54lnDr3xIyNJoR zKmDtBHCrXgMV2IBwbjzq/q+n078jMkm80ijDY6deaP1ojfkHSQ3PGxbwGhV1YRm M27Q1ERHfjzz5AkUfqBDcvKcM3OuHS3ZG+1zMNH/iMFqNCaRWoE6Wp6FXHPPeiEa cXJzMKZQmUVpSmiYgiBzFRUORxRB3Rx9LGWLffmANYNcNH1h5nF67G+ZhmY36Iag WwKw32lfz4hB6Zw7lNWIQj3Vbo7y1mCTu9BQPU5aA10UE7arXVgJIPIkloJI9+6w 0qxWmJMjkPtI2RqhCehpnjDYjZTQ6cEvAASeUWLSx8kgJCMcSzovTrkngnLuB2+I C3TC1/RyoM8mc8JToWDXoZ17h2LxXvaERlydFWQmOuh1MrtKMr3Nvs/qgvcgzTs8 /Z9yu8FeDbkKfO9+wgN8aHOMpjZxg/cVjTlpkdai6BsrakXq7A9q+opY1FMsMkoK sS/94PWXJawp6KSMRRJaLp9vD9FgbkG54+IuPG55oOQ9C9dycOc+BZtA2T7ed3h/ AN0rt6e1GENmytHnATRxemsCncFSYeXEGXqEua1SrTUvvutl2Z+CSXhL3t8lD9M7 i4ti6C3cqvTTSGZn0lA0F1syL/JFGN9BxtinT/v2d2KJzlqHS2UCTRxx/l5oe0OF YdmCi9r2phtPO95IrrYbPuiLFC7ZkbqvHXRfu31Qpe8r3On0yPEeep8NocXu1Inb p6x0P9SYSDmDgpyFSKNqSNpuCLPCyVhBwjATPvhbplDbNMmpAzOYma3QAE4vpZTg A32FVN6h0cNKoFYBcms3Tv+8D9od9bE5i5TdCBM2qE0= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4F49254CB79C126A
-
http://decoder.re/4F49254CB79C126A
Targets
-
- Target v2.bin
- Size 121KB
- SHA256 74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1