General

  • Target

    2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil

  • Size

    164KB

  • Sample

    250323-d5gvdsslz2

  • MD5

    561ab11981e5132b6b1a724762ccf77c

  • SHA1

    320a039b66f1192e4f654fb213afd7c75852a35b

  • SHA256

    1e962caa271bccb44def63a5b037dd867bc87dcad038e5279b8e64a248fda23c

  • SHA512

    8e3e0697bf3e74830c8a283247850097c21e998ccc32ca73471a9d97523fc3e7ceeed40d9417a31b6a46c9bb6ad75b9ed3d738580d5037b039f2dd2235eb70ac

  • SSDEEP

    3072:70XoUeZ/DVS8L7flcMTeYWik3LvFflPE51TkT:7eoUeZRlcYxWVTFf1E3+

Malware Config

Extracted

Path

C:\Users\evg59fhx-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension evg59fhx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7096D9F858FD7E3A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7096D9F858FD7E3A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7indU2M607He7z5EeUTTI3JvWo20i7UtOdXt5Rqwa/Yu2C2w0QyEMNH1h7tssxmp cK82GIlj5mrmVqENXpeQzH0ol8xKiypvBo9MaUkQjrTUYr+OoZ8LJsTRVBwQ4Ijl +4LRLbFugZ+Sj6oht6YiqrqRJtbQmVR2/OTnIEwN5txsIerqvz4C87/cI52dffNx TMq7aHqy/5lYiCNWkSf4jFLXH2CC2e/uPLOLdhnZg2hBd7i/r28/GT1AWUxjKaN4 g5+vOjyXXpuIfC8jVjIhomjo9uFvcIC/pnFikPqjI3ZGoxxronUp/KqKmwxB7oZI zppZPAl2vdzjQ7+KkKmUq3HzA3n2PrIUGv4wyaZacqRoQByLAW35gEnm+kfrNBLL w99j1jOHhVnyvzhmy9O175yrnQTQIHNzbtBryo95o+FQu01J0nxV0GAjWbXmuXOO iZvkOHzpshn1BE2FkgU/WBXudy8Fv5NWzFWzykeg/SpBh1PXkImWxGACDRIAzIMu VtYOwU4kAHy2KrYS7NFlghtQ9CZ2Gyh0fb7HXGN566olItFe5QbNuUK+KQGvQhNf 5EAtoj2jFSEXOM96+AVwmf5JUPKlnusLZI/QeelJK3Kj93axOG57+yg+OLOZrBGd z8JPmKsGfcbTeupt6UZn1HfsBRoHIuhy7lpYm076pkCPJgFNxxhM3Dlnx/x9d+bZ Xosi8VUWeCrzaUQpnMwddAsCWUCQEumoVwDqMQ1FDPgJE55lV3wj+FjZ+u7cfDhU mb751ihZFgruR9LHTyOL4CtPHcr6HD12JdlEp+xqX37YbtkEn7l9w250oprSFzs/ E4NBhj5xEtFAQMJ0zPUvrgPU4qzbJ2z13b+bZ4Yj6n4aHQ03yeZAJxBD54HUVjOL aivUb12afCZzasA5paL04ISWLDw9vsZnmpSL1Ki5ZWvxbQJBYOKASb82qBxBH8su CSxkmMoC5+xMdzQm6wHkBVMUDfQmumZhmqjNL72zsEKVpOaED0fYiXwqjqyak6Hx 6gEy9/hLcR4+6/w8WAsvc8KnBa8AWpHYdpjzebeEqoMnaLkEsh3hBcJFkBwJXOvt rR8sTJ8m8VSd9czKRw1U7M+qj+IvzHDjTLpfEIEk34ZDtyXdoGsNjZBndPFz0pre nvlfG+T1adgQCt6TH5YXsxVuREyyTl38VT3gDeUcI2SJWCgkphqx2Wd0pC2ddibY eOVwk5L3leFnKySGqj5v9g== Extension name: evg59fhx ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7096D9F858FD7E3A

http://decryptor.top/7096D9F858FD7E3A

Extracted

Path

C:\Program Files (x86)\rkv4qsvvz-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension rkv4qsvvz. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D037680A85741923 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/D037680A85741923 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: KO8KErqToHNEIJQnDNFBp/H8jXp5OI7xMMZkeL6q0kIHNyUCsyQJG1EbKnoPO/7b 8gAuTlnlgLbgxJizQsVuu3+CL70ICYGyuzAeWN16PwX2ZVHFfPfZThj5IkRrtMj4 vHDsls7KQ8TtarFT58MtLbtA3QPcTlhub2B3ClIJIOAyWl6YAgqY45eG0RwlC4ae FE8PUqdslQ7Bwq2Aw6L/sZz7r6cPvT/Xf3MYHATzjHexLc0aILpiWswusdksdI/B VKkpxo4eZcY/geNiz0SR50XuzHkhYl2mN5BVkDXF9SDqlsJB5jAyOzWJwxOZJRZS ItP+W2yq58uxAg7bmZDhi18Ppyt0Uve0700tiuj3xBp6fdieNXf/FosIxBgkSe8j TaDKrCbhYsst6CrQKbt9t5hzbintW0PRns0o0ZEOXRdn2NS8OFrmeJ97MJKodxts /TYji5GJl5d/jVaq4kuq+Pl7cp48PMZDjL6tRESrnPvgoHkg8DGn79ZEbAxh1kDT Ydb8aRAMLH6U7MEIjBRy5md9PZczv2ASn2fFNc+RBYafnTtnSH9XUDXt4llzsUR/ GV+cN3HpvBYs8GSI+6Ja92gGuTnG8GmNfHZ8KRwEHyYWW7x4mtKaswzJyifq+gV/ 9rRNNbeUJxz1V40wmrDmNcxdhacMqVANwlb2uCQh8o5Zh/zjvTwp/ywXIXOgQvQs 6Es0Pm9cCMTvCtJdnwKyrlB9oqvLG2uXz24iAO5OMX9GggN8YaPuLoQBKC6QPtY9 Fd971dWLKyeB+tkLX6yolgLWRC+pUOFPJpEXhyNoxJMZfVA6Mb5V/iU1Lu4BG0at RfonNSYahTRWMpLF3QSJVTd+YRuHZ28H3+NnRP9dEbDwB9GMH4RQS2fFBoBiH5k/ 1f6i4TmsJLQHt5NrvWBZnAb/Spqz2dafWb6Pb/VrLskA34YxkSsV0BGPAVcKkQuG 03paHcW9QQlTy3hxP1QUVUUu0+zjBZdYRnBARStESg16Z2egykmwUgTMUlbmFu9J 20xoEIYJG+STHKMR7pw7j/7dK1apTWkKQwEFBr0BNa/upLY7HHmEiD9OGWlkHYK5 39eDv4r5l6Z6sITSC5oiuEU8M6oqnjJFNaiW+tGEE3jWu2oEqkOz1joPPVxroGTB aYZIZrf2dszVuazCgKvmGZdDOD/PtkD1wOHv/Rxk33FW26Dc+mTuHXSM5cX/eB8+ AqGLPHyCgWoGhbv/SWUKRbu9G6uD43td Extension name: rkv4qsvvz ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D037680A85741923

http://decryptor.top/D037680A85741923

Targets

    • Target

      2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil

    • Size

      164KB

    • MD5

      561ab11981e5132b6b1a724762ccf77c

    • SHA1

      320a039b66f1192e4f654fb213afd7c75852a35b

    • SHA256

      1e962caa271bccb44def63a5b037dd867bc87dcad038e5279b8e64a248fda23c

    • SHA512

      8e3e0697bf3e74830c8a283247850097c21e998ccc32ca73471a9d97523fc3e7ceeed40d9417a31b6a46c9bb6ad75b9ed3d738580d5037b039f2dd2235eb70ac

    • SSDEEP

      3072:70XoUeZ/DVS8L7flcMTeYWik3LvFflPE51TkT:7eoUeZRlcYxWVTFf1E3+

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks