Resubmissions
23/09/2026, 16:58
260923-vg6bhsfg531006/09/2026, 16:14
260906-tp1kkawtev1005/09/2026, 18:17
260905-ww6fhagk9y1005/09/2026, 18:17
260905-ww55qsgk9w14/08/2026, 18:05
260814-wn795abb231025/05/2026, 01:59
260525-ceefxaat4n1001/05/2026, 12:22
260501-pj17pabt5j1021/04/2026, 16:21
260421-ttqadsht2l1021/04/2026, 16:07
260421-tk2xtscx711019/04/2026, 20:34
260419-zcnccsey4s10General
- Target v2.bin(1).zip
- Size 73KB
- Sample260323-whcw2adv5n
- SHA256 f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554
Malware Config
Extracted
-
sodinokibi
-
$2a$12$lTqvWf.cQvh9W5jZkAk9LO0hMLnifWtUFoBJ86Ge.hLZGVClg6xhW
-
7563
-
commercialboatbuilding.com
-
parkstreetauto.net
-
longislandelderlaw.com
-
lbcframingelectrical.com
-
assurancesalextrespaille.fr
-
smale-opticiens.nl
-
naturavetal.hr
-
global-kids.info
-
kaotikkustomz.com
-
klusbeter.nl
-
socstrp.org
-
stefanpasch.me
-
jandaonline.com
-
beyondmarcomdotcom.wordpress.com
-
nmiec.com
-
sabel-bf.com
-
edv-live.de
-
zewatchers.com
-
controldekk.com
-
berlin-bamboo-bikes.org
-
net
true
-
pid
$2a$12$lTqvWf.cQvh9W5jZkAk9LO0hMLnifWtUFoBJ86Ge.hLZGVClg6xhW
-
prc
oracle
excel
ocomm
onenote
mspub
powerpnt
synctime
agntsvc
dbeng50
isqlplussvc
firefox
mydesktopservice
steam
winword
dbsnmp
ocautoupds
thunderbird
sqbcoreservice
ocssd
encsvc
xfssvccon
tbirdconfig
wordpad
infopath
visio
outlook
msaccess
sql
mydesktopqos
thebat
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7563
-
svc
veeam
svc$
memtas
sophos
sql
vss
backup
mepocs
Extracted
-
C:\Recovery\1u676698-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1u676698. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/24463B5355F9697E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/24463B5355F9697E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Cgu8AVbyZUn13ENI2cSAb68Gv9rFUOT5ZDQFeVZKVw1xNd1fuebDNsliFY6vq6Jb o0KQOjlCyUts9dDD1EPlieGDpwUVjOdjnukDtRfY/Q5jCs+rZjP6eTUOK8nSLgp6 PYxlR0ldA25q1L5t4mB9YIhe1BctjZBIdIcKiKXkcTm3KDKlg7ja+KK1R9wp2FFf ra8yMULv/JRC6mqLfCdshPjBv5ZsFBiC/O3/yaqnSfUcRLZVGTuvk/cevNgS8zYI PmMGxY641QzP57dHvz6VKzKCCp9geMpe+x1pnxBYPOE8z3G8vFFba2Kpc4+CUlQo 0dbIHG/2ILbOAOPOKQTThxCrkXWK2m7VqnURzgYsx1pUHqnmAJEi19dCSHdlDD/x EMp3SPaS3UT6vE1xkbtw+bfqSUOxS4Qm95WC0vyW6S50qHZVlwtnrVcHpUB304jg UOmw+BNE88IwX4GP5z1JZLhtlGO6cTCKO0IaagY+Nlw3ndzdSaU/GKG3EHESv1iW gcuNnPmM0sebVweq03lL1s9/PaDcECFhZUSr5Nxqk4hJ2QISMednGr9peXukdWg6 flGzEyDL7UdGAcVA2a8wg0i+hKE4n/8xsej0xI7P9rug43w5tRNE+U+90CLEqNYr SnN184PIcUeqvBsNOH7BKwgWY3JYLZTBhV1aHdKW36nairZ9URE4vkZSBGqXJQKV V9bp9vJtVpH1/wfnafXq5KtjBB8ybFHijZ1ZWiQKdcAJVh+ljwKtWakkx3z/p0vZ wzKl7dNfyqNmWwQhFhR4bsxQri6JaU2+sUicU9wo/gEFc02WpaiD/IbSk0P7VI+J WgvvaM1tFlPbjw5TeapL6+1LVtE2JpAsSZD3IDd7UJGXt262plY/PfnI/KHeEumq 5y5rpjII0Eq6KH/YYpUoCe2urp2VN/rJfgYO5HX3/YGULdNCb5zRU4tOt1kB20EI I9SC6uDB5SXvwZ1yxZuYZXdS8n5ocgPLuOrui2ieOhNcClgkTCcQ6SMm2ZG6c5ZK EOexWlxC+alMMrVqmnoX69xi0jjzC75+JQTG8qGdWyqy3GlpXoU6/VgH7r3ooIuz 8X2Oa3B7hlRhlv0Hag+EN/Y69apONI8SYboqtQ2pUoheP3AkTmO5/4FgjRnfAPr0 3gkiwNCin+D+q6JqvEAkW8G64vN9jIoVdROpR3z7a4vte3rd8ULNmrNaNdLAbmH1 SLTIsXMUuijk05YsTsAdQOPU60dCKxD/f4xX7vJN4yvHULzU5vOyyDfMiePVhPRz R1kibmuJuIw6HwZHJTBqzC9OXivgP0hUScnlryOcbhywx/P6LTIZG+2TgObukWQw 5THZNHYKZ+332C5gFjLlcOrBalvl3Wm1BpdVQtIU+Kg= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/24463B5355F9697E
-
http://decoder.re/24463B5355F9697E
Extracted
-
C:\Recovery\u931a55k-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension u931a55k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DA72BF2813E73D06 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/DA72BF2813E73D06 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7DrYeasKCzzbfA7BmWQJqpS2cSXNZVhwSYt5ZBLJRN76VqU4nD4AhRRFiH0xSw9v 7A/7zuV2JrezCRT8oS+6bnA2H8rUQcxPPYuvMmr7bxqJYzYwtlS7liu+WwQUE41W 95EB4oAXtDyf93qsEBtEkDTBVcTmUqFkNJNg/rODshYKTNGrzU2gpP2kJ5LN7jNd MZLPxDFk5LY93ej3m2QwQpUEkIYLVeqfhlz13ukTa+DP/7RZqJqfzKHTtiwo5TW3 +yGg1oWHoiKx507/wJnKe08gvmhMgGDeAiHGvw/I7T1emfYMjwFWhA6csUbbEvDl p9VOyfo+qdeYGMypbleyduxfYYT2lpygpKOEcIkkbHUkspb9EKwrDVuuipjiOjfN HdBmEHhU1xOyNr+p1ni9WzbCqzYnaQ0nCr6AAb5hTxEO7HPlaMb3mFQEyngOvHFN mrgkz1qt9hXTPzC/PX6O1ZkVtRtgrMvWV8nGPmBKJh76kc5pP6x0VJ2Zn1q/RC/r /rmmdtBCbBRc7ZUOMR/6aycUCD5lbd8eHjPqEZwPPXN9k2Soi3diwReeTUbWTX58 TCZBJDl6YwFWEv2FPO+iDY2JVnuMXZPXwcsEPmwX4twrpaTQRO4wE4kyxcxsbEfm vTsFaFGJq6KT5tWouWxst4w9WDoe4Ii8kKnih4fb4eztQfxtZ1PB6+d+WVEBVZW2 nL7R8/xMEfFBmEPhD7gcXqfUeKsSwhZjpkEzO0iqBVsNowKDztFtXu9y+eISCe1e mYR2wPzvCZ9dm6XvS6f7CbTx44wb1T2ChtnxKI6lzJ5PxVEwjyf6H/NEKNBscrbS Tsvd9vJ9QpK/7aBu0QGdAwWDYD4xTT8IdFdAf2F88SUR3XSvL6rhiqyeSbWQXabz UuenvM/aiDeLQ+/pFR71/5mTvX3V+UmMlfDERlMZQiXTgxt/j8QQzOLf1gJNKs3d chuSzMA58BX6ZcxuBZ0IELAZHQkAJWsWrlxZhOxt1VTCC0/6AN/hI4bfq/k0lMFV a6kLx5UyqU9/Moj+30EWrF2roMZcoXsoEc8i/xHodrHaCOyfr4i3V4pkJrL5p48K G/YZQ4XxBWC3JTn8zVXeNGGghmw/VM1EQExYoVx6hMYBek9/R3d9OvDgs6Y8dqsE B9IvQJkmwTU3cJtjoDGC9krYFNfZG1GpVklNMgNC574EDmrcV4Q/eghWJTHyXfRm MMpSV2DWB6E1B2DpRqPIIXvyPeY64PPJJOtVQE6e4+H5xzMD/QvbY4kWrbP1PP67 7Q6cLxZdtFspjuqby3gqZKbkfwM5XbGFQwBqeC2BSJtbduX1FilxcrhdL7HfNtDg S+yzuIIBmkPwSo0N0SlzpV9s6AbDIu/aSi8QpenKBNM= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DA72BF2813E73D06
-
http://decoder.re/DA72BF2813E73D06
Targets
-
- Target v2.bin(1).zip
- Size 73KB
- SHA256 f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554
Score1/10 -
- Target v2.bin
- Size 121KB
- SHA256 74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
Score10/10-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Sodinokibi family
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1