Resubmissions

25/03/2025, 13:41

250325-qzfrcswzht 10

05/02/2025, 10:51

250205-mx3lkatjgw 10

30/01/2025, 12:43

250130-pyd1ps1nby 10

General

  • Target

    Sodinokibi.exe

  • Size

    822KB

  • Sample

    250325-qzfrcswzht

  • MD5

    4c811aa6fa4b6c24e325b0d71b84f710

  • SHA1

    389666ea397b3c51aeb147c8abb504c40b906d62

  • SHA256

    412e951a350b84f8c0d0a2db79029b4bbd6be624656f2a739db0fc00c6dbb52f

  • SHA512

    c33ccb7ed3c6a34d38fde8d824316012bc094abf7f62aad4472a00622500cd7a58cce43a13a26d8680d409a6a779ff36369669f97f91eea8ee50bcfd63f6fa3d

  • SSDEEP

    6144:NYk1/mCXu8BCnsq4MSt9kM5zaQrV+eXR:N/11u8BCnsq4zX5zlV+eB

Malware Config

Extracted

Family

sodinokibi

Botnet

26

Campaign

2361

Decoy

jacquesgarcianoto.com

csaballoons.com

buerocenter-butzbach-werbemittel.de

martha-frets-ceramics.nl

edvestors.org

mediogiro.com.ar

annenymus.com

circuit-diagramz.com

linkbuilding.life

endstarvation.com

nalliasmali.net

domaine-des-pothiers.com

floweringsun.org

haus-landliebe.de

mac-computer-support-hamburg.de

block-optic.com

gsconcretecoatings.com

osn.ro

vedsegaard.dk

grupoexin10.com

Attributes
  • net

    false

  • pid

    26

  • prc

    wordpad

    vxmon

    CagService

    visio

    synctime

    xfssvccon

    VeeamNFSSvc

    dbsnmp

    tbirdconfig

    thunderbird

    firefox

    VeeamDeploymentSvc

    sqbcoreservice

    thebat

    powerpnt

    vsnapvss

    agntsvc

    sql

    raw_agent_svc

    excel

    infopath

    pvlsvr

    mydesktopqos

    beserver

    ocssd

    EnterpriseClient

    winword

    outlook

    onenote

    oracle

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi

  • sub

    2361

  • svc

    sophos

    veeam

    vss

    AcronisAgent

    BackupExecJobEngine

    AcrSch2Svc

    BackupExecManagementService

    BackupExecVSSProvider

    mepocs

    stc_raw_agent

    bedbg

    MSExchange$

    MSExchange

    MVArmor

    CAARCUpdateSvc

    memtas

    MSSQL$

    BackupExecAgentBrowser

    PDVFSService

    WSBExchange

    sql

    ARSM

    svc$

    VeeamNFSSvc

    BackupExecRPCService

    CASAD2DWebSvc

    VeeamTransportSvc

    VeeamDeploymentService

    backup

    MVarmor64

Extracted

Path

C:\Program Files (x86)\nv0csx837m-readme.txt

Ransom Note
---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension nv0csx837m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A36523C961A980CB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/A36523C961A980CB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: J2/Nyfatv3cgR/YnA/3GzpVa4nReVho+PVPP96QvKPcZWmx52jycO+6ZOhnSx7Y3 eB1Itru+Rak9UIpg30GBivye6H1MLFcj88CXq6uk29qr5T0JOwiW1WEfWHCfO2iU yMjKCd9tIn5FluRwHvarGr3dqWUl0vaVV5tdZkrmoISFJyjn4uaCl9CIG7lthpNW LvCyTg7XOPDmUgFCwokGFupQ/ZVWnKQ0PnmuFQqfHhUwvby2e7m3KbkP1+9zsh9E lFEDLlOBc1iC1qAOPwa2IlAkK8Rej+OI56DikbuoSY4qoZ4+VcYw7AbRdVzPqN5B fysulUIbFy7Nxoi/isThqxfP3n8ajin70Ig6cBjGQc+7x5Hfk7iiQyCO929/K31l gwoKwkxBFg0PSX2IrNY8sNlcvx6znNO6GYnnH82czwh7PS840vzWuVbYG8kQBz6m sDh/EQsnYWp6QsrKBIJl8dCRFeL+vDtcjHTkUvBLmUDw2eAtg81IPep2ne5J8zTq H4q0KUvXJi0D5Ivq4WeGwXK4SjMpPbZ4dj1wkzL01qMhFvUJuIvtQQo3ekcSdG0J fjySQOZkEFsy4lHUfAVmQ0BL0+/aeQOQSPQCRFVc4wIfmT6M53+fFHCH8a0xHMWP EvicSKpum0bdRCDa94HvomK9gI1QsGiIGrI4gPgnRRPX3tlJqzwwYGZEqwKhhvT1 FJfxP4+R39PQ75/+dPZZczbPgV/DgHiR9sKLRvv61H+9PQgGkkOwy6b5QmM1qZsL wiTmaatQZajhtH+Outdba+xwEHIGnta9BlAm7xsaEWDkU1wS9vR+4f166WFTwv+Q 5w6JJxvd0XcZS1qzD7dtGiokv9bVggwalN59d681p9iYpLbqxNvRga4g4dTQjOd1 /2VehEpQVagc4NHhgRbNBgkcqVpidDrusgH/zXG6WTNgWRwe4f3nFVdPN7VYzY2b je/85Ci8v6CzpkUoB6a/Koyxq/dH75Cdn8QMG4ss6oxNF9Wh4wlfdvXrpiWKkPV1 RaOvfTuFblPVsxmaE+k6XZkUVo3WXtoBumVr91wD4NoQX8XRLEmJZ2RRrAPM9pha SNNLLyl+tJX7kUxPNBEpF2Xhn0seGHgk6OdKNy3QKQRn1wVVmeWZV/+F0WIz7ov/ ans3la3qKaCRtgPemhF5RbT721KMAKfUCDYRp/RHUgPqSEzsjIIrsfTSk0oKSvcp L1DsD5VpcD3PEBc6WrESzGsTgr0qNKbY38g= Extension name: nv0csx837m ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A36523C961A980CB

http://decryptor.top/A36523C961A980CB

Extracted

Path

C:\Users\d1t0q-readme.txt

Ransom Note
---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d1t0q. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ED945CE783C687D6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/ED945CE783C687D6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WBQ32j5rTNBgSgO93SHc7TalxITjdgasx/r5JwVzV/UUvbCiJABa4udyvFzDmJak IV7CDpFcrZbdMER+3+c9Sl9usIk75Z8/x/Baa11yxgtWJtR+TFEKmPoumvUDMxL8 oOQK8yABys3+2nE89dwF900ofmGhFivL/jXF9ZOrP428Jwqflo6wwBxwohoU+URa 7t4U8MW7vj5Bf3Q9RYVQ25/CD7CnjMo3P/VkCX+rY/epvAU68t0g30gDdYFbGK9E aDAGdDpVbVwSsPGoNbwMRNI9enGScIeTnW11X1Q1/J6Vcc395qI+xe7rWfD6W+g/ M84YaOrbAlyLOiDlGU8Jwp6Dr8Pd5GScaZk1BNRwXVrxEuh/RoR+Ux6mUmhe44vL 6M8rhZAItzP3cIgvo/p7ny/9gK1pQvQbXq/8tdrO/e/l4y4aKS9LRS4CKb/8DqEj GIB8f4kfuvbPf2wWRPmBvmGS2VwUZOg5mhd28LLRM4Q4NktGmsXrMRcGYXVqi+3n 7HzKjdDCsQvH8cUNbx6TpQvsfMBqmpyRNM8F7Y5hYg6WFsbU8G+KZINxEVwef0k1 3dWYLfwHdNdeILKC7Q+RyXRHZtMbblMYwSo4Srry6lBkIt99tmJndqMEsu2nJNW+ UfQ56NNzJgwvVWTtluLqL0oL3KZicI9L45d0ThhtNxAzpQzc49Cd39fyV7eYf2Oy 6zyxG1kKN8Fpko8duo551/CE1MQZ/HgVpGpjwy6feNtsv+Cj5d3MzDvQ07oFe2tU kyuyWwkurZyKjsNekCpcD0oqIygRFCc2s1r4nSpRZdm8E4OgDmUEhiUMgFGlsrdN dVVT0HsVCnp7B/2/RvbPNmKS5nyh9IIkiGrpWO8gHrfdf9Qcj7Siy+InB1w0xf3F gQkUr10Wd4qicKloUcX/jdyP2mGORaqFv+NO2Vpcou5uSLchdhb75z9+ydlk1KTK 8DW0UEw/GaYZ4NOkcb4RbEMYbmHVayAsrh+Ty9NjlV3D2H+g9gTpB5+LnLGO8er9 Y3gfnFZq7fpRDL5I7CjYFJBTEgcfAfE+mD3yYMDT3jr4lwF9r/LMJl/aw1/VDq49 242J60mMFDbXotbBMxSbyk0dDvp4V+MSSRYs0z9C2yIVwna5CTObO669nArWV7a5 dDblWyt/Bp0s2pPwXLpnZ8vwYNjL70kfzrTCK1Rrh2dmih+iJiYthZE6vt+P7Jp2 z4VsCiZ08BF/Mg== Extension name: d1t0q ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ED945CE783C687D6

http://decryptor.top/ED945CE783C687D6

Extracted

Path

C:\Program Files (x86)\16w8cy978z-readme.txt

Ransom Note
---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 16w8cy978z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/83933461B08BDC1F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/83933461B08BDC1F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NUm3im8+Xxf5aXpcao5PqzOyQBDp/B9epPI6vERRJh3Kl8xauv90oSPswJkk+mcs zwX2CmtkFGjyqNXT8GU2+djv6Usl9YePohYWzkifJn3W1LaO5sxIypkQ3jFNz1rp K6mLvRQcFpYmgI3D8VdxlEmVtp7Q0f0BBrUbSQ1xchPSyD9Lp9tHCvXDX+0IvFo6 +Mvjcbcu/b7NjqQ4K19pFxRCYigfBkIZSwi69cZh2yY7YAXwJ9rMzTQqdgLngLoL arJE8NxrZKgd7eQnN1/oqss0VnPP9rlPJIMpobQKlAhQwqcZofarolM9bHZa56jL 18VQ4P4azk8qK8S7mKhpJyTiTSvDwwQrT+nWMl0EeM5b5Di32Zt1BVoyFVR8aNcC CGDuq0LN1Ip1969ybykm+06yxrEynP53DkFEwCmMZ2PG/GIp1tNDk25PrSx0pyl3 wQrdToVziDCDuS+iIBTvZzioRck1xbHk8p5SwDZm3yz0I2bgct85/8iW1xxvglsw oCmVKDIw7PYdMie1TFQnqC5uqRykS2BHCAHdZGArK9YUwaTomv2Q9taGnV+XjqFS IktNHuBBWip3CxOrDMzZPekOYtQ7WyPkcDqDJvXuSzugZodcsUOWc5+3vZMQtH1I Ke/AtNYgEgSv1+sPOQxeZPW0TCPnM+QcU0hKj02zOOUMURs2RzWxKe7e9FmWIp5b jaTJOaFK/QPEL5VNX7FGU48/KGwzXCTf6NTYU0NIHL2IEaK9vq02fX7oA03JpbDz 2TdJSBRU2DPEmJHNqWKwUu3FkgWEsQE6AunIITuDbUFpgUV1O9+pGFbjtv6xxFWg 7WQ4bbqrNnCUvge07quSpHcb8B5W6F1tkzwW96YkYZd0eASE5k6O0/2j+By2WP0w ddxCc4DY49n+xVgpvlBWw95da3gvCAJEEf+FzZKDuL4mjTNA3ed8B7re2tIrRnY/ HH+Vjj+bOq5PUu31bLFU+HZAG8k9IUJ9MqnC1X8g5APCx2VWF8B8ggmQnPOl2OCK o1mMr16CncuaxmzMQ6VoG3dYtyQIOWobgbi10bSQLK1fdmr/WXoit5A4PJo+cDW4 zNHS8WRvt35sldejFGlF2ZYUuuQnewDu8CWdnAb3xG+4NFWCqiuZZEJhogUAhIgz AgfC3zyMYr1Y6VUuzmglmgSWiXD2uvrhD5ta2335A3GrqBo9AlcTbmcrJwEhysHK QvpjOI0sHuNFa9+2y4E7Ojbo+CQ9BLGyVQs= Extension name: 16w8cy978z ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/83933461B08BDC1F

http://decryptor.top/83933461B08BDC1F

Extracted

Path

C:\Program Files (x86)\8m2agp-readme.txt

Ransom Note
---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8m2agp. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8260614ACB873888 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/8260614ACB873888 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: O3rqpKYWj7AjE/zMScAxa/ySLUrGZSwWM4C8mAeoTMwLuNk16goxQXzPk5vtwmc8 /rF0FDL631koGrb2U4S0o6VXRItN/vk//LsZZI4PSzCWTV6FSxVsh9xE/vnpX5yY JlZgj+qgZqmBkX9fUN7RbPMcM9RKt6jiM4b3YL+b59b3vuCWISLQskQQmxIHXjKO r4mehNzpg+xFb4CvlpHUyd01h6yrvtfP43QWbKWFXTCE9iPSZ3tm+SdzgidjNzK4 QX8x8/5dyP9GncgMI4i5dvF4AlI7haA6eumTA+XDnSQYRWBioikfWrLLAj1W+7lc qZNtxDQgt0BYjO3zYZltxxZSwFTGFxAjF1YHbolbAfqPTB23o4RVNpkI89HpZF4c MyQhtEctsrc1NVBCN+EFDJ45pPRAHNycokVuEQAtxfUTHaq5W//GpWH+iKYdEZ+J USQcuj+7HmkoO7f9OP7gFlHtLNoVnc/XwAij9anZnvdNH97Gv80WoU86so0yruZ6 u6mFmcmnI8f04Z8sjAKRRf5rPuUXuD4xw9iJ5v1kKA4GtDBb4iLN79dtDHvqOjcN sUICexnmTFyfr+t6B/JEuKRt4RSw2Dsxum0ou9mtDki2FJzBeqJeOOA3zLjNzmC0 nZJPNnZw7faQjGvQeFREmI5jhDgj5r0IeP8bO4yNVDMvlvZsJYaMCMUxgCoJlOsE 201dbrm1I0jcYXQHh+491ixa7DOeW/SplvghtJe5KDPrfIuro4K9BvDRHQMH+Bop yo7Wj+AM79rQkFhUhrMGPp7RGuZYTmX8E/LRAh2xpYx4u3Y+GU4zv81X0OfkvCgF +XoKpek+mgvdHHLQ6idLDX/zmLi2bf2ZvSdJoesvafKToRULa4nTmkoYyOUJDvdn aQ2ElOP6DECkXkb0G2GRbAY6Fshq11SAssOsIOkiCK3EYoKU5d2DeZegyr67OqeC ptoXqQxpFnjvV5Ygzu8eNpDsU+TnIvM4fZUSCKOFnktC2T0EzHuENRuzafYqs/uB G1wGdupPSCP4J48GNGstrWFLheqZ4dVB6VvqdQjJxyjQmu8Jrl20Wf4oDE0QeCIj /VVSCeKNkhdHxRkS9Q9xoYlIqRK8nIgw9dZTp+PYJ6VpDWD7XEMDkiy8lEphpekK B1o+YTjW2dcwZwctv06kS7uXont1eL5mBLbiSNXwZFCenKA/l7MN/ffhaDRTj02b U0zJ5oxkgv06UTJh1s2KRst2v/uugQb7ekLQKB2ONUM0XSrnJr8= Extension name: 8m2agp ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8260614ACB873888

http://decryptor.top/8260614ACB873888

Extracted

Path

C:\Program Files (x86)\n95agzb-readme.txt

Ransom Note
---=== Welcome. ===--- Merry Christmas and Happy Holidays everyone! You have a great opportunity to enter the new year, leaving all the bad in the outgoing year. I advise you to write to us as soon as possible and not waste your precious time that you can spend with your family. With our decryptors recovery will take you the least time, without us you will have a very hard time and some of your files will not be recovered never. The longer you think, the harder it will be for us to negotiate with you . Waiting for your dialogues in our chat, below you can get acquainted with what happened. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension n95agzb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/71839F0196583679 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/71839F0196583679 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Jn5AO5ggWLrxlI79UoFQD5Sk/l7YlpLBRme29InD1eycw347zT+VTGIJLs8x3urc HGlV1OjO+STvwTjsASYg2ey9JTkybNHfy+tRQMDGnNICDsv/ONpPd08XOkFSknBt P348HIILVBXLfVllLGlSviS5hFDWrpLUkfRC4pl5huS45niRIvMPuFgPkStvHChv xGocsMcFkewrZqkmR/Ns5TJFoVGP6l/dwQUWWvrA1hNh5QjhxVAa49h5t6U4xuYc /IMzwLG0Z+LO54MXpYhRB6m4IZf2bLgh6u86jJmiSPW4UrnROrpWORinSGLFPijE H8V85y/P5sdB59YqGQEfV1Kwsf4rFKFswEva+YNBJK4X5SihsG1sK3G7bCcERY4+ V4+6A/FDRIyNFEzQ8KwHnsDdNHgnydkjc+RpIQ6rH3J1NidxebL4E3SLvCkmy1zh 7KsZr+gLWGgWcmkOU6JOJ+uPh5dNdpLNGc8cBvxsuJmLZoJwd17xs39+3hg7SB2K uufjnO5rIxqECljWyFgoxQK3Rx59mAuEIO+moBexUbpF+oqUZyJpB/JDw/9VoTx4 Z43Ic54WoOmhdgb5zNg6yAn8lQ0x4A08RvEjYMKKbVnyelc9vgggJgYetFwKGMlS QvgZ5Pkb0uN3DflmdNRW14s2dB514CluOPbwtBMdv9D7dx4xmvb1P8lOawPk/fZU wFhB4I+lDYSUFHq6X95JyHpE7YECnyoILTyb0SdKZpz1pcbjoyJL7UIw3vaTTtYW 9ruvx2rn317woCaTZ3txMj0JVYoVvHbe3hOBx26DpQ0oj1fR0BLQ7N/9Dcnrx4Lw 1r3jumm00tJmQH+90EpdFU4/QlU8TxF5RyRNvR8YHccpHCm66h8qU7YVWXaZ8vpb EjpaMTKbcmcaLCNof0L7HzmZNiX97VYm+lEtDj3MSKEg78ujFAK3Jjfp1DqS5QF1 rsKHl121yCRvssF/37GiwtPQKhGWZFMZcbth0tmD066p5DUlY9XAdUYjYon7Lfn8 vcOKRrS4aJAEiZO60AykxiT2P2NE63DgxCZ/Vfvm4TyzEuiVjVvqjNvT4ASDBGDf /HmaYiStzjGI+LbRNPbRCdkKw07ZBtoac5nSYvrm8t9oT6wMsnB/WxFFfX1sFLgu leLuvnAN9dYsy8jcAt1C43acgv1bJbWrvK+Ula0nVFRtW6wlH2nDLKsA1WTr1N12 8/zY8YcB9MqGiwy76Fv+OB9Qp3w= Extension name: n95agzb ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! For google: Revil/Sodinokibi
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/71839F0196583679

http://decryptor.top/71839F0196583679

Targets

    • Target

      Sodinokibi.exe

    • Size

      822KB

    • MD5

      4c811aa6fa4b6c24e325b0d71b84f710

    • SHA1

      389666ea397b3c51aeb147c8abb504c40b906d62

    • SHA256

      412e951a350b84f8c0d0a2db79029b4bbd6be624656f2a739db0fc00c6dbb52f

    • SHA512

      c33ccb7ed3c6a34d38fde8d824316012bc094abf7f62aad4472a00622500cd7a58cce43a13a26d8680d409a6a779ff36369669f97f91eea8ee50bcfd63f6fa3d

    • SSDEEP

      6144:NYk1/mCXu8BCnsq4MSt9kM5zaQrV+eXR:N/11u8BCnsq4zX5zlV+eB

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Sodinokibi family

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks