General
- Target 2c5bb7122231abee264ce69ac9b95274f13f29bc1452872932126ac3bac46557
- Size 411KB
- Sample260812-qqtxmav1ds
- SHA256 2c5bb7122231abee264ce69ac9b95274f13f29bc1452872932126ac3bac46557
Malware Config
Extracted
-
sodinokibi
-
$2a$10$lz3hlPV8Kej9uci3yqtcXekYgZKNgrmR77UkrVKzbLWKZi9Qz/inq
-
5599
-
bxdf.info
-
homecomingstudio.com
-
ledmes.ru
-
modelmaking.nl
-
corona-handles.com
-
botanicinnovations.com
-
cerebralforce.net
-
conexa4papers.trade
-
aco-media.nl
-
igfap.com
-
danielblum.info
-
colorofhorses.com
-
bridgeloanslenders.com
-
kao.at
-
kenhnoithatgo.com
-
qlog.de
-
spargel-kochen.de
-
kamahouse.net
-
naturalrapids.com
-
luckypatcher-apkz.com
-
net
true
-
pid
$2a$10$lz3hlPV8Kej9uci3yqtcXekYgZKNgrmR77UkrVKzbLWKZi9Qz/inq
-
prc
thebat
msaccess
onenote
agntsvc
ocssd
sql
oracle
ocomm
wordpad
mydesktopservice
infopath
sqbcoreservice
ocautoupds
tbirdconfig
isqlplussvc
firefox
winword
excel
powerpnt
synctime
dbeng50
mydesktopqos
thunderbird
encsvc
dbsnmp
outlook
mspub
steam
visio
xfssvccon
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
5599
-
svc
mepocs
veeam
svc$
sql
sophos
backup
vss
memtas
Extracted
-
C:\Users\f2s3m0-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension f2s3m0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C5DC0957171CBAFF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C5DC0957171CBAFF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: VxYw6VLN7U7DYZULYjfS3j8U6fJQtkyAXTS/XnphD1jNFy4FGSSz2YjS3pMTQgC4 KeSXqoawyNoa75rD82tDDb8BQV2sWStJZcSCsFx7T+yjKMLOokKFOK6Jb/hNt5TF IFvTYHIy4LvS275gmKFs2P+gjan/93WCIrNmMod1nquDbaf/3i1mBYMS3SdG/rim RVKV2ClnVvdAUCI3rA/3zvtgkKnLupeoXhDmbHOi5/sUBtrek6Piu5cZR5lojHe5 RCgHABn8llHOPugBIeMMO/nxGhoiOiMr5JA0O4WUmM9oN7HbZtwdYeBs+uETrcez s8Ofv4bf79bNEJZOF0CMKiaKEhsMGT72bE/x2euu4jjuaq38avGw9A5ilT284ttl 9np8Qv8VppFFhmFBn7w2KFkcT8bCeQrKHR+K4rRh6wAoK70Z+POct8n7WOuQvnam ISCetXOSIvVTJzTweS+W5EUziL5E5TxX9Zm7Wxto5bdGqJyhXrWaOPFH7Q1aIQih pUrh9NM0iOdXh7Ch4XVl7+MOPNrupL5gjuOHtSBzQhL9oS/cM0XZjVZpybdNp7ja 5IDx43kuOpHv1dHxStJ/NjtXjxooz50PnRlTiGrzxQQ+186I7+OfQsLg9V/+q2zc rCf5O6nwiTJBHUNqRzcSLnCROqIJ1a3nZAVLrbm0aS4oZSgBBPnpZlBqB9cBV5M8 pnJhzMxwpEmp4L8p213DSFpvgF+nuZ2XfKgkk5maGMpI7TK0bIsB2mAqQ/UBFQMN 1HKkyd9vQeem/kv5MIAGoBPaCiO8/5r0YRdstUG4NTsjQUI4M2P/YwutTUIhV4ud H+AmNsMlQ+XxZ2o/IsV7Bl8XuqiAsDcIqYR/EhCunTceID4op2E9TlAXfCwdSiK2 Y814RvKb3m2DS/yF7Y7CUFJkp15orO9CzXkv22kTOL4Ow8UJfT/QPkKye/Lafp/O 591dqGgVD1gqgVl+o9UE/UKTvOOJC+F8rj6v7757lAqFb4XqdcoYkeCJ311jKohS qjTKSlcceA9ODXs64+MguqSDZ7D0wCxH0gfDM84HXGebulVa2AVBlbNIkInr4/KC UOXF3FO+aKM1luMEjc6Nbn26Tdlxn+ui4nPYIpEh5r4ByIjQo+kvlVdqFB5hlsyB pjb55p75SnjYY6naqdpikpFxH8MPEjoOdpyl3H6mA+KhhuJLjEnTNujGWilNpbta wmzXqLHUO5GgDfcjhiwr4TsKIocrpO9Afd6pVLKxaO7azfnyYHmdPFVykN8eCOrq BuvZpMAOQFJPdl/9p8fHUxmMzHNMf/6doBzlDUPhfL3QugZ0TbZvimbHEqSa07Ku 54EXzbuzLOA1uX/UKrdulhM+P7e67t6CiOsRZHjeXzcw7J7U+RM= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C5DC0957171CBAFF
-
http://decryptor.cc/C5DC0957171CBAFF
Extracted
-
C:\Users\ey275-readme.txt
-
sodinokibi
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ey275. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9C97E8FFBCA418D9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9C97E8FFBCA418D9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TsTTqiyaF8nm4wLtc0q+5SUSTi8MCLNhXZr1xhd9WSyMJLb0T34vL+wF0vQJxDyV lRJP64+vw3/PI0rbiUxI9OEchaFutbQu2Tn7whZdnNHn9CRp6aWuLN/CnjxpG1FJ sZYUQIVQB0K0URCgLtZg5oNrnvKkbrknI+y6Uiisw3dKYzh+5/HuSZHANTxBrM08 om3fH6LyZqnePRWpA2VTzj/k4ppkIOernmGGxPgpU4C3D0zvnvCGBuOAOfDOONEJ yeBYR+mwMEl+Kzae3OFXL5JiOfn9Hff3TZj6g3H9lAWg8FVE1eIyTfwwOinBDCzQ q8sNcJv+U+7ep8fO6tpDU6MmHW2huTm5rIlSwrni6jcsPOMBIP/DhqIk02YBcPFB YLrLwxqqyPmy1WsA6cYBduk4x2nXO6ZfJG4KppFVzgkI7UqapDzq/kFsJZB8Sym6 XN3I4SqDDl6mynuynukF7TuGGj1f6fmFdIgMG8CDFFh+Ul/g7AHOPDIrZIFtkAzH QhYS9LDp0Zth39g6eqIUVf0ozVG5EGwLMbN762JwKq1v7GlNHKXhD4AzBC1cmFmI cFfMjhtPepg11/EMYSB3831CqdMiS2Pi44XvIf2UvcEzoj7O1edv7IenPOZoiJey jJN/5RG4tK0H/enxHh2N23X7X0PbOu2JUPBQbRbpfBiu4FUJis2RQf5ffS7UXvG0 /dB3qWHbFYwo2zyB1sUTYjMMHrMl4uVSOTnRtftoyJ4rhtlSYcHnT1TNjkN1XwBJ l52WKznY9OeIsQyu2BqRLTaR/Zc7IcClKh8Wr8uyPuwVLwTuIxwHetpk9WyHk9et PA/6ULzBUroIj7RJ6EaxnBALnxE0H/RycmlZh3KByf65wKSeDXAnnh0QpskrLdPq I5urZowY2LHc0KtJ2yP8XZzpCVQlR2H44IL8a4hJCtaOGx0W/im4HItz3eE7o+5H RxbXMoF22Cpett70m/Zj3757mzMndBLqqc7xYxSmOOL6oR/aTHjhq07h/AZ1MGY7 eclre6YxSuNyNoDMtRYi3JIQOUeaX6Jj4tdm+DuvzaGSetskdV3DYiUjfBpzr1X4 OKodTR4x1SyyqknpYEikxXho/fSNI37nACC15oUo6c547RoEp1S6EnVWI+WBL4VI quESu2U6MAxHKBIPma01hAGT59fg9ewk0tX//HFIKvRoAsSKEpwMkkC4PQ4lPl9e LmVLA5SBVhT8yOMGmt6sg507r48isZMkXDW5wU0JobZwJyRnaHJGaST4LpXPbjGc sfkhnXMO2y7D6yl19o9dXEnPuMSYbPCff5tIzw95yAlsfyDiLItNBft4mSx9TjA9 5b9IX9cXkHjOQR7sU+6a3O6b3CtS7vkMhHijqAdKuYSgT4EwURhR6x6PlZTN1ZJz j7xw1FXZTQw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9C97E8FFBCA418D9
-
http://decryptor.cc/9C97E8FFBCA418D9
Targets
-
- Target 8c716101e118ac65d7bdb900e0100d012256abb1d7cdf64830e5943a795ccce2.exe
- Size 600KB
- SHA256 8c716101e118ac65d7bdb900e0100d012256abb1d7cdf64830e5943a795ccce2
Score10/10-
Family: Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry