General

  • Target

    2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil

  • Size

    164KB

  • Sample

    250323-d1lmsaskz8

  • MD5

    561ab11981e5132b6b1a724762ccf77c

  • SHA1

    320a039b66f1192e4f654fb213afd7c75852a35b

  • SHA256

    1e962caa271bccb44def63a5b037dd867bc87dcad038e5279b8e64a248fda23c

  • SHA512

    8e3e0697bf3e74830c8a283247850097c21e998ccc32ca73471a9d97523fc3e7ceeed40d9417a31b6a46c9bb6ad75b9ed3d738580d5037b039f2dd2235eb70ac

  • SSDEEP

    3072:70XoUeZ/DVS8L7flcMTeYWik3LvFflPE51TkT:7eoUeZRlcYxWVTFf1E3+

Malware Config

Extracted

Path

C:\Users\88kqf-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 88kqf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/99C9FEDADC888618 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/99C9FEDADC888618 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: OkwN5OKCQ71NI1YN1//VHCVTy5TLFf7/GRcsDXKbcQrszYpMTs6UtTlYD0FlUCjI hsCvPvTBLt5mZITE2u5hHM910BnDXwOnM9XtJRBLj6H1ieHy8joVkYOxkipW9oVK ly5j6YRAUOAV9oAKroEZV5A4EEVi5SBiuRJM7UbC+az+q4a2+CiORi14Yt3Nhrux wTmbHq/JF6BE88XtKG6YY+VyeLreIR+6j5F5RIg0hO+Ty+yUoZSMQRdenfs9eGul L9jEjJb2GYvHvj3dbhFH+b4J8PEYph4MPzJDiUtTqb4fC4HieIsQoK3zkSdQZnkl avwS2YFH8hBh6jpvrb8v0hHJgeOmz79ikWV+9fGbaH1uV1SFar/4+QHDfKSl55aI l7seHLa9PGsVwO5pRNN5mDoVLf4WjC7rvcECsTA0ZVSMjr4ymv1UlSSiNS3anD0c PmsMTjyFGtECY2EqeqjcoPBuxIiVR8Kc3U6TXFsONGcg4Sxc9sskvp9xjvGpUWNx blMOEcDxbXYbmiNs42j6BXkYbUNo8AivecrytbOx2GOrxAh9NGQLLtpJhvMlSbrl OJuzPzxeO/LvXndj3sOetsUzsRPdVygKR3rbeItLm0+OAIA8wLSXzO4WxkDGQnLr BhvH8H46L7so38Li1ygrxqKNFxB+BCN/1plOvgaid4xgkxM+1gDMLwh2QXSKWOxm WCMhCvjflESJ6eSLdjzMK+rc9iylc8bXW3XZTBU8hIi7Mg6ewbCR2nuaWlXhczVJ EgF+ryvNNVKDJSGscUsjzBT223qch3IQDvEDowtTkMjd43qibWMw6Y32IsASXLjl lA4tVtmOZGcgvpb4mpzcMiGiA2hgsZNkfWakFhVGF1BPpU0Bx6e0H3DkxZBnM1gQ Txq8GppDNKRuxiWAgM6bJQ2z3u1Np7nhZAJoBSGcs3jr8Tgv1+6+o3xx18tTuEbB VH+PeP+O+GKZSr0UO56ZO53RHb3W0kYW3c2MyhSvWM+LtXYSOXijybTEuVcp4clR WJlomnqNhFDiosPEPydm1r4g4rO8c8cidZWFoVvk8/Gxw24E6xsSzOgIzRu4aof5 nWoXT6JI1tdzdU2DumlVfI+2Pu3CwsbWmn0u4gQIKoBvJJ6RWqdBtav+m4BPv2m4 lvYM2UrMvBk+N3f1YE/vXP6/bPKvKVSs9Rr+MHP+RwPDdCreqnHPjWsHWxIraAky TfGbbUYV04MqZQ== Extension name: 88kqf ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/99C9FEDADC888618

http://decryptor.top/99C9FEDADC888618

Extracted

Path

C:\Program Files (x86)\5rla5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5rla5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C506E3D2266DE50E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/C506E3D2266DE50E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5BfN/ysaHWno32YwG0MKYnO7P2yANwKL4Ad2vriOv70qC2ZSZLoG6rFFwcUt88cc ++mXPEZIlZrIt/G8NKufHkRGsjnsLX8wsdt7jtXMlAZK4772swVOnU0SMVp4k+vA ectFImUmjst58XUJN658RxihVMqCd60MwuwXcce5nWBEmqJYLIL7LRLbFL5zFppN oOQkUEzRu1aIeVC6rvcyEaSDFBXchRNZJFk4vUIXM4+rYsVxDLWivAXgLJfFZ5ZT UwDHvTO0HOY80WZkvpWV4kR6L/Q8YrfMmbAHWOr/4lpeeXVvIZKiDmub+W3QSSrP EhqpOrrIEnSqVyLUXvgZD2eDgJ+gGGvxYH8RSwtnfZq+fSSHeb1WZSRVjaQRz0xn 3VCxthFA5gKWcvy+Y6gLXrVPAW29vAa8C1Q+9wo6TW9I09R2HjwG3xrBwPmRieYG EnO4wC/fg9gEQcnaWALwJACbSDxx3xgcrUbY0Qxbe3ZGcu9pv0CPqbGrY0vc+wYN 5Bre0ho8IfVnc7L1t5UTJsVlyxK/mgAMldmQ95GjR8XNl2xiB2uXRCchl8bLLfYc k13gqzvhUibh+RWBWz943TclvPIgouXcJUucJ9sHUi+3GBLsbG94FgKGLBpw/iv/ /9ZPtAC0hf+VrRcIynzz01DPlGRT3YifipvJq/EPiuJtKyOEV3CXc/ih3VM01dbc mXvOsr8i/faEvI4HMvBH25DZE7yfELK1X4LEq0Zgnyuc1ZBXuH+Zy/OvC9jTCsBd 1LfzdNjgG8EtErxeBmW3NQY//ufOaOBDzaaoUsHtezwkCw6I9kNKz4ryO+9aLXJa /4Vixi32Ao7iYnGGFoy8waEv4OcZdhYjf97WMe2/vNGdbDwIs7keM40dvHWUnOdS ALU6IhM1ej0Hyf9IDCII3n9RixLVFF2HPgs9MH691rizkxrMUpLBeShNescXOtNS 5toYScYXdT51J5y20gGQUa8g3p1S0xV23+qkO7NDJTUcndi5r+mO+GvxUU6WGTjA 12Xj4tkHmK8cWtl8KHUfSmKRp9dNACJqQnxTap5ko4RvUtJP6kTEpY/8J3zoSjgo HwKUaElMqrMFnKPkSI8JRN7klBGG9iqM980jswnBH7WOugoPORB7mZsEaUCEYBkl CSx3viV0pEjxPOqKjxc9zWteh8QqayQHkHacjbrDcljbAQ/kYui3av+1wiYrH0bl W7rxqFADLlf0IbqGcvj7HA== Extension name: 5rla5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C506E3D2266DE50E

http://decryptor.top/C506E3D2266DE50E

Targets

    • Target

      2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil

    • Size

      164KB

    • MD5

      561ab11981e5132b6b1a724762ccf77c

    • SHA1

      320a039b66f1192e4f654fb213afd7c75852a35b

    • SHA256

      1e962caa271bccb44def63a5b037dd867bc87dcad038e5279b8e64a248fda23c

    • SHA512

      8e3e0697bf3e74830c8a283247850097c21e998ccc32ca73471a9d97523fc3e7ceeed40d9417a31b6a46c9bb6ad75b9ed3d738580d5037b039f2dd2235eb70ac

    • SSDEEP

      3072:70XoUeZ/DVS8L7flcMTeYWik3LvFflPE51TkT:7eoUeZRlcYxWVTFf1E3+

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.