Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
23/03/2025, 03:28
General
-
Target
2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe
-
Size
164KB
-
MD5
561ab11981e5132b6b1a724762ccf77c
-
SHA1
320a039b66f1192e4f654fb213afd7c75852a35b
-
SHA256
1e962caa271bccb44def63a5b037dd867bc87dcad038e5279b8e64a248fda23c
-
SHA512
8e3e0697bf3e74830c8a283247850097c21e998ccc32ca73471a9d97523fc3e7ceeed40d9417a31b6a46c9bb6ad75b9ed3d738580d5037b039f2dd2235eb70ac
-
SSDEEP
3072:70XoUeZ/DVS8L7flcMTeYWik3LvFflPE51TkT:7eoUeZRlcYxWVTFf1E3+
Score
10/10
Malware Config
Extracted
Path
C:\Users\88kqf-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 88kqf.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/99C9FEDADC888618
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.top/99C9FEDADC888618
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
OkwN5OKCQ71NI1YN1//VHCVTy5TLFf7/GRcsDXKbcQrszYpMTs6UtTlYD0FlUCjI
hsCvPvTBLt5mZITE2u5hHM910BnDXwOnM9XtJRBLj6H1ieHy8joVkYOxkipW9oVK
ly5j6YRAUOAV9oAKroEZV5A4EEVi5SBiuRJM7UbC+az+q4a2+CiORi14Yt3Nhrux
wTmbHq/JF6BE88XtKG6YY+VyeLreIR+6j5F5RIg0hO+Ty+yUoZSMQRdenfs9eGul
L9jEjJb2GYvHvj3dbhFH+b4J8PEYph4MPzJDiUtTqb4fC4HieIsQoK3zkSdQZnkl
avwS2YFH8hBh6jpvrb8v0hHJgeOmz79ikWV+9fGbaH1uV1SFar/4+QHDfKSl55aI
l7seHLa9PGsVwO5pRNN5mDoVLf4WjC7rvcECsTA0ZVSMjr4ymv1UlSSiNS3anD0c
PmsMTjyFGtECY2EqeqjcoPBuxIiVR8Kc3U6TXFsONGcg4Sxc9sskvp9xjvGpUWNx
blMOEcDxbXYbmiNs42j6BXkYbUNo8AivecrytbOx2GOrxAh9NGQLLtpJhvMlSbrl
OJuzPzxeO/LvXndj3sOetsUzsRPdVygKR3rbeItLm0+OAIA8wLSXzO4WxkDGQnLr
BhvH8H46L7so38Li1ygrxqKNFxB+BCN/1plOvgaid4xgkxM+1gDMLwh2QXSKWOxm
WCMhCvjflESJ6eSLdjzMK+rc9iylc8bXW3XZTBU8hIi7Mg6ewbCR2nuaWlXhczVJ
EgF+ryvNNVKDJSGscUsjzBT223qch3IQDvEDowtTkMjd43qibWMw6Y32IsASXLjl
lA4tVtmOZGcgvpb4mpzcMiGiA2hgsZNkfWakFhVGF1BPpU0Bx6e0H3DkxZBnM1gQ
Txq8GppDNKRuxiWAgM6bJQ2z3u1Np7nhZAJoBSGcs3jr8Tgv1+6+o3xx18tTuEbB
VH+PeP+O+GKZSr0UO56ZO53RHb3W0kYW3c2MyhSvWM+LtXYSOXijybTEuVcp4clR
WJlomnqNhFDiosPEPydm1r4g4rO8c8cidZWFoVvk8/Gxw24E6xsSzOgIzRu4aof5
nWoXT6JI1tdzdU2DumlVfI+2Pu3CwsbWmn0u4gQIKoBvJJ6RWqdBtav+m4BPv2m4
lvYM2UrMvBk+N3f1YE/vXP6/bPKvKVSs9Rr+MHP+RwPDdCreqnHPjWsHWxIraAky
TfGbbUYV04MqZQ==
Extension name:
88kqf
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/99C9FEDADC888618
http://decryptor.top/99C9FEDADC888618
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 34 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5eddf23f9d8a3be1640a9f36e39a74fde
SHA13dfebd70348f5007783d2fc86868954b94d3a734
SHA2566b0bc9adf6e8e9e343fe71dd8f2afdb994eff5308ede4b51ce26260c455c9233
SHA5120fd040d430b2f4ca9ad46efc2633dc37bad095f3d8c1465e6c95dce3bbfe323b93410b6c21991b81602763171f480b368c034e800456a54828827b8cc8cd5c2a
-
Filesize
24KB
-
Filesize
124KB
-
Filesize
1.2MB
-
Filesize
636KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
40KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
1.0MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
2.9MB
-
Filesize
4KB