Resubmissions
23/09/2026, 16:58
260923-vg6bhsfg531006/09/2026, 16:14
260906-tp1kkawtev1005/09/2026, 18:17
260905-ww6fhagk9y1005/09/2026, 18:17
260905-ww55qsgk9w14/08/2026, 18:05
260814-wn795abb231025/05/2026, 01:59
260525-ceefxaat4n1001/05/2026, 12:22
260501-pj17pabt5j1021/04/2026, 16:21
260421-ttqadsht2l1021/04/2026, 16:07
260421-tk2xtscx711019/04/2026, 20:34
260419-zcnccsey4s10General
- Target v2.bin(1).zip
- Size 73KB
- Sample260525-ceefxaat4n
- SHA256 f442d0543f6df79be9fbaed90af2dedbcf2e4774561421763577b148a9ff8554
Malware Config
Extracted
-
sodinokibi
-
$2a$12$lTqvWf.cQvh9W5jZkAk9LO0hMLnifWtUFoBJ86Ge.hLZGVClg6xhW
-
7563
-
commercialboatbuilding.com
-
parkstreetauto.net
-
longislandelderlaw.com
-
lbcframingelectrical.com
-
assurancesalextrespaille.fr
-
smale-opticiens.nl
-
naturavetal.hr
-
global-kids.info
-
kaotikkustomz.com
-
klusbeter.nl
-
socstrp.org
-
stefanpasch.me
-
jandaonline.com
-
beyondmarcomdotcom.wordpress.com
-
nmiec.com
-
sabel-bf.com
-
edv-live.de
-
zewatchers.com
-
controldekk.com
-
berlin-bamboo-bikes.org
-
net
true
-
pid
$2a$12$lTqvWf.cQvh9W5jZkAk9LO0hMLnifWtUFoBJ86Ge.hLZGVClg6xhW
-
prc
oracle
excel
ocomm
onenote
mspub
powerpnt
synctime
agntsvc
dbeng50
isqlplussvc
firefox
mydesktopservice
steam
winword
dbsnmp
ocautoupds
thunderbird
sqbcoreservice
ocssd
encsvc
xfssvccon
tbirdconfig
wordpad
infopath
visio
outlook
msaccess
sql
mydesktopqos
thebat
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7563
-
svc
veeam
svc$
memtas
sophos
sql
vss
backup
mepocs
Extracted
-
C:\Recovery\393k904j-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 393k904j. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C8AB677A0B728638 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C8AB677A0B728638 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: YVYbChZuFb+5JmZGA8KYN5EJxlHXsWTKlm2tEHG068RGqVyDF0YsgvBiiTAuEqu/ YFRyO9OIXHse74YiNOxeFXCecAtLFBfajIN1Xgnqdd0OzmHPNdlOt44NWHcNaDOk EHY28kw4z7apzg21k37svIyhf+PrPl1Bm52Xs+N3B/EFn48hVkjJA3vTopYseckY wC13XZFrnzezuhuC9HwqwYRI0uABmsSAQTLDi5C9VLiE3gp7NfgXD/GlajyBxX58 WogcHcktbCvUUS3b0qe/pFUzZSVljNVlKGcIAbr77C93wKbHKV9F9ybloy6ZJtsu k+DC3j/75Qev9i3OnlZwoQqu4mrs3JEp/C4JcJ0KgiMp65x6VpphlGd9Yzl681lv cnQ17tnKhz81iVo24KkgK0HPPH8ZA08zyioOa0u5aV22ejEB0vD+8jcXwur6AjL4 h6W7fLZrcdvXsoAjNCrQGek7ASgw6VKYXy3OCEE1pLXt8DlOcrXUDPAwDTi3hXe8 sPtukCzG5fOZwVyZyB7N3oQHNPBVMNSn2SBUjXRnWDfKBCjWFlRThzHO5ElcFzRx nNZ98HEWhG7BHNLvUy4vmnXC0wsqfEUdX9YeXeRZD+a4ADFfDVBzu/rXr9Ttyjdk UUeH/vRKeIGurL4s+4+ebITvRH3gMa4bs1jj63eQjaEBuubCpJEDIKaV8IsMxKr+ hY/My1QQsMg3RXGFjgmKflf9/qizCxADQfVEz8t7DqPrt8vKQk5HcGJONLzzF6ab 2goj8aXF05WbSQbokXtz/d8uoYR0i0bc45KpB5AuWHQ6NODGP8ahc6dK3hbB6ZP2 f1GQX6/RhV+T2oMShBdtyLaelTcwMSnfrWAAEAYhi7z0ZZut9HtDbKQ8ozCXEY3P 3DJYQdxlSeIfn02i9JMc8eqtTz+O3MrtbG7cVqbHYho413L196ZEY7KTyML4GdAj WFqPtBJg9f3pALJ3NjkYqNrqqYl93H3lNhqOpXI/bV4T/LwuWtCnSgrmZ0WfhBOR FxM/CVB8ZUnqXaLzAFp3yYQEFNwD/pqlSaJWfZjT2++a/8gHkxMnYFdNx4pj0j/4 fAqktJrleQdH0OyHEXUSFGaFc/5CbO5DabnnzytqSCF6JIymWeMJEtgLegzZPHto MacKOHghdPoH0CgOKUKSTAa5LKqs3WDLQ451S+tFTfNDSqEjGc5IRBkVN1427+dI 0cs8AxDjHOWjYAncUxDLAf1ZBjPlyucbGCLoq1HPwo/gJUzwYK4imDNHJXgcWcdj TsSVw5duNU7fNPPRlVWJdBqroJpaq8gkiAFZajhZLybaFydNVQCd9aRjpQI9HyR4 KsMxzMKM8gXTaEUBx+0fe8FKNysRpZ0I/Jv1vm18PqM= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C8AB677A0B728638
-
http://decoder.re/C8AB677A0B728638
Extracted
-
C:\Recovery\5xhyws2-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5xhyws2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5B9D2CB96E57062E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/5B9D2CB96E57062E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: iz+CRf8dCC2NTfaruf0ItsgKAHD4eeKh6hKyFcBSVf6huVD+7EFUwGHW1ufkmbwo sOW1wNm0shMcr+sewLcoaNrvD6V08Xcsqe4geKIKCwqixU4gEUuvlcMoSyY3cLJG kgaUZsl32lfQDnolbtZafwgVmDXOazcUXFMVZ6I3u9JL5zkXRB6wv4Fsse43qTOX xEfQKxjgMQovwgP1NGnjxAhLnNIwCcS4J0gge4C6AjfWKoLXzwKTsSQ+jq9nsOQ9 cc+Sy0eNuATLR22yjLb+fpslB9yxZ3eCinnTr6WcguiB0hL4fKet6dT9EE99atzh IsrCR4NXTq//xA/cpV8FRYG4vt0JxHelHuQc9RfE4qN4MNH25jzEGhdfoQoBz3WA Y7+/3oy0YdPgffS8bx0QjzYbEN9bRD4TULuHp9OUcOHj7wGe3Uin7XbbnT0S280A ZYrDPYZ9nSW9HUI6hSKqdfR3l5XBFlh65Fza2L+3tfHLnrW4d5z2H/QGTW+ZM0/X 7lWAoJBiJR9n6bLgCYAdfo2NWZ8dF7qdmGgD0EBO5e7OnNSbDUKsXKlTSaYC60t/ 9HxRBJU5GTUbULFjVwahdsyFtk8ZfO0VLib6K42iKnCfQSXVrqpb7gwLl6eftOSO rI/FcRAcIvklMJRdUS15Qi6NODya5+iqNj0ms3PxzbQkyn/2XR+FLzL2WIrmKmj7 7ihXUaSFEwXhWAzrJ4Tv/L9NpCf9oHL+rRgTuPqq86WdUfIgioz5K4o79mPwsqKR jYYMilePilJpgNxqEaE5LrkXa5LkUhgL84rmsU7nc7dw9z8XLjrDhCojPglVI1TS xdlYI/aXYJ7HJMdc8M01noBfgrCKfD6QG0jUvXPOofQ04wlM6fjaIt5Z9CSBtPO6 mzYV0Ap2nmVkzbjo6Bfe176+x8zOh3U0CCz1UqThInRpZ8AvxkgvXTqh1ZsvMlKl dwlEyIYwdUfMm9CTOs8tYuHaRwACWAggoGpJynDl0s/HCxRyFKccGm7NlIAgHeWQ KfMquBngnHaDiQetKrB7DX+I+ItUFFKUraZ/WYECHdvthFLtsbgcb28FxCQiuI1H a7fTOADcg1zmGM8LP6AL1K85LUYPRh79zZtpCdNyBeSH4r7oxLhtehX9f+WrNDF9 jotSDX0o9fRf5at0I5CnQ4wuE/hVqn9pUDo7fm/kT3038kYl2rmvhkSLv3SxkKM9 V/rOdc6YgUicNOJkuLZ5M3zxD+7Gib2rA9MoWREDHeYFm/GFitvOS1qR9TPXo2MC JtzhDMT1qS0T8bRF33sW2S9ljGxFX2UqxK5hEzY/fPAAXRAhuRUEFWc3eCZn9sQ0 g130dX0davzaCuxlJQa3q/9JCbJLBKsv+E+aio8R ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5B9D2CB96E57062E
-
http://decoder.re/5B9D2CB96E57062E
Targets
-
- Target v2.bin
- Size 121KB
- SHA256 74ce1be7fe32869dbbfe599d7992c306a7ee693eb517924135975daa64a3a92f
Score10/10-
Family: Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1