Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23/03/2025, 03:35
General
-
Target
2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe
-
Size
164KB
-
MD5
561ab11981e5132b6b1a724762ccf77c
-
SHA1
320a039b66f1192e4f654fb213afd7c75852a35b
-
SHA256
1e962caa271bccb44def63a5b037dd867bc87dcad038e5279b8e64a248fda23c
-
SHA512
8e3e0697bf3e74830c8a283247850097c21e998ccc32ca73471a9d97523fc3e7ceeed40d9417a31b6a46c9bb6ad75b9ed3d738580d5037b039f2dd2235eb70ac
-
SSDEEP
3072:70XoUeZ/DVS8L7flcMTeYWik3LvFflPE51TkT:7eoUeZRlcYxWVTFf1E3+
Score
10/10
Malware Config
Extracted
Path
C:\Users\evg59fhx-readme.txt
Family
sodinokibi
Ransom Note
---=== Welcome. Again. ===---
[+] Whats Happen? [+]
Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension evg59fhx.
By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]
Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.
[+] How to get access on website? [+]
You have two ways:
1) [Recommended] Using a TOR browser!
a) Download and install TOR browser from this site: https://torproject.org/
b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7096D9F858FD7E3A
2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this:
a) Open your any browser (Chrome, Firefox, Opera, IE, Edge)
b) Open our secondary website: http://decryptor.top/7096D9F858FD7E3A
Warning: secondary website can be blocked, thats why first variant much better and more available.
When you open our website, put the following data in the input form:
Key:
7indU2M607He7z5EeUTTI3JvWo20i7UtOdXt5Rqwa/Yu2C2w0QyEMNH1h7tssxmp
cK82GIlj5mrmVqENXpeQzH0ol8xKiypvBo9MaUkQjrTUYr+OoZ8LJsTRVBwQ4Ijl
+4LRLbFugZ+Sj6oht6YiqrqRJtbQmVR2/OTnIEwN5txsIerqvz4C87/cI52dffNx
TMq7aHqy/5lYiCNWkSf4jFLXH2CC2e/uPLOLdhnZg2hBd7i/r28/GT1AWUxjKaN4
g5+vOjyXXpuIfC8jVjIhomjo9uFvcIC/pnFikPqjI3ZGoxxronUp/KqKmwxB7oZI
zppZPAl2vdzjQ7+KkKmUq3HzA3n2PrIUGv4wyaZacqRoQByLAW35gEnm+kfrNBLL
w99j1jOHhVnyvzhmy9O175yrnQTQIHNzbtBryo95o+FQu01J0nxV0GAjWbXmuXOO
iZvkOHzpshn1BE2FkgU/WBXudy8Fv5NWzFWzykeg/SpBh1PXkImWxGACDRIAzIMu
VtYOwU4kAHy2KrYS7NFlghtQ9CZ2Gyh0fb7HXGN566olItFe5QbNuUK+KQGvQhNf
5EAtoj2jFSEXOM96+AVwmf5JUPKlnusLZI/QeelJK3Kj93axOG57+yg+OLOZrBGd
z8JPmKsGfcbTeupt6UZn1HfsBRoHIuhy7lpYm076pkCPJgFNxxhM3Dlnx/x9d+bZ
Xosi8VUWeCrzaUQpnMwddAsCWUCQEumoVwDqMQ1FDPgJE55lV3wj+FjZ+u7cfDhU
mb751ihZFgruR9LHTyOL4CtPHcr6HD12JdlEp+xqX37YbtkEn7l9w250oprSFzs/
E4NBhj5xEtFAQMJ0zPUvrgPU4qzbJ2z13b+bZ4Yj6n4aHQ03yeZAJxBD54HUVjOL
aivUb12afCZzasA5paL04ISWLDw9vsZnmpSL1Ki5ZWvxbQJBYOKASb82qBxBH8su
CSxkmMoC5+xMdzQm6wHkBVMUDfQmumZhmqjNL72zsEKVpOaED0fYiXwqjqyak6Hx
6gEy9/hLcR4+6/w8WAsvc8KnBa8AWpHYdpjzebeEqoMnaLkEsh3hBcJFkBwJXOvt
rR8sTJ8m8VSd9czKRw1U7M+qj+IvzHDjTLpfEIEk34ZDtyXdoGsNjZBndPFz0pre
nvlfG+T1adgQCt6TH5YXsxVuREyyTl38VT3gDeUcI2SJWCgkphqx2Wd0pC2ddibY
eOVwk5L3leFnKySGqj5v9g==
Extension name:
evg59fhx
-----------------------------------------------------------------------------------------
!!! DANGER !!!
DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.
!!! !!! !!!
ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere.
!!! !!! !!!
URLs
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7096D9F858FD7E3A
http://decryptor.top/7096D9F858FD7E3A
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Drops file in Program Files directory 36 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 19 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-23_561ab11981e5132b6b1a724762ccf77c_revil.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5ada815c04d07a4aa631c300baa73d846
SHA15cf202210482279cbe127a9bfee77faf10a0ee13
SHA25669af15e10abdc4f679768d4a4adbbbe5e1a8597b820aea7e51440ab4f2189d25
SHA512ebe6c58780f65604dfa9240f4ea08373b723eebdf07b97fccb2d7b1f8aae13478da6c1bf2b3ed9c7aac70bfb0681b257d1fa54b58f708175366c955e163cf0bb
-
Filesize
1.2MB
-
Filesize
24KB
-
Filesize
1.0MB
-
Filesize
124KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
636KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
2.9MB
-
Filesize
4KB