Ransom.Win32.SODINOKIBI.AUWTM

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

It drops files as ransom note.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %System%\catroot2\dberr.txt
• %User Temp%\jl0.bmp
• {encrypted folder}\{random characters}-readme.txt

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• powershell -e {Base-64 encoded}
• %System%\wbem\wmiprvse.exe -secured -Embedding
• %System%\vssvc.exe
• %System%\svchost.exe -k swprv

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Ransomware adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\GitForWindows
QPM = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\GitForWindows
cMtS = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\GitForWindows
WGg7j = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\GitForWindows
zbhs8h = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\GitForWindows
H85TP10 = .{encrypted extension}

HKEY_LOCAL_MACHINE\SOFTWARE\GitForWindows
GCZg2PXD = {hex values}

It modifies the following registry entries:

HKEY_CURRENT_USER\Control Panel\Desktop
Wallpaper = %User Temp%\jl0.bmp

Other Details

This Ransomware connects to the following possibly malicious URL:

• {BLOCKED}dc.com
• {BLOCKED}ce.com
• {BLOCKED}gital
• {BLOCKED}roskitour.com
• {BLOCKED}studio-visuell.de
• {BLOCKED}nhweeks.com
• {BLOCKED}perez.com
• {BLOCKED}osting.nl
• {BLOCKED}geln.ch
• {BLOCKED}selle.fr
• {BLOCKED}ortsequip.com
• {BLOCKED}box.ch
• {BLOCKED}urlabretagne.bzh
• {BLOCKED}eenbiomedservices.com
• {BLOCKED}bcleaner.fr
• {BLOCKED}ofwa.com
• {BLOCKED}amcfadyenjewelry.com
• {BLOCKED}ntonline.eu
• {BLOCKED}u.fr
• {BLOCKED}hakapitalforvaltning.dk
• {BLOCKED}hardmaybury.co.uk
• {BLOCKED}usk.zp.ua
• {BLOCKED}dboyscustom.com
• {BLOCKED}agostar.co
• {BLOCKED}chsale.biz
• {BLOCKED}eroes.dk
• {BLOCKED}ton-avenue.co.il
• {BLOCKED}ogenforensic.com
• {BLOCKED}iabolmong.com
• {BLOCKED}zaropi.com.br
• {BLOCKED}chup-mag.com
• {BLOCKED}arrot.com
• {BLOCKED}ored-shelves.com
• {BLOCKED}d2muscle.nl
• {BLOCKED}esacademy.it
• {BLOCKED}nisverschuur.com
• maryairbnb.{BLOCKED}ess.com
• {BLOCKED}inkdetroit.com
• {BLOCKED}rome.eu
• {BLOCKED}r.com
• {BLOCKED}us.de
• {BLOCKED}artinezilustrador.com
• {BLOCKED}iano.fr
• {BLOCKED}rhappyevents.fr
• {BLOCKED}nshenghotel.com
• {BLOCKED}insburger.fr
• {BLOCKED}kaip.ru
• {BLOCKED}erium.com
• {BLOCKED}ukumbak.com
• {BLOCKED}en-praxisklinik-rostock.de
• {BLOCKED}vait.fr
• {BLOCKED}uiblog.com
• {BLOCKED}g-blog.de
• {BLOCKED}nstonmingmanning.com
• {BLOCKED}865.com
• {BLOCKED}talcircle.com
• {BLOCKED}egationhub.com
• {BLOCKED}donllp.com
• {BLOCKED}istopherhannan.com
• {BLOCKED}esa.com
• {BLOCKED}case.com
• {BLOCKED}plettabordeaux.fr
• www.{BLOCKED}d.com
• {BLOCKED}abalhos.com
• {BLOCKED}tactodirecto.com
• {BLOCKED}nti.com
• {BLOCKED}ood.com
• {BLOCKED}ngcrane.com
• {BLOCKED}talk.com
• {BLOCKED}ag.com
• {BLOCKED}ements.nl
• www.{BLOCKED}lhoogeveen.nl
• {BLOCKED}enter-butzbach-werbemittel.de
• {BLOCKED}w.com
• {BLOCKED}ingplanet.com
• 2);www.{BLOCKED}t.ag
• {BLOCKED}odelrio.com
• {BLOCKED}ebell.website
• {BLOCKED}sta.de
• www.{BLOCKED}sta.de
• {BLOCKED}g.me
• {BLOCKED}llity.hu
• {BLOCKED}chowo.pl
• {BLOCKED}shandbrowenvy.com
• {BLOCKED}erich-umzug.ch
• {BLOCKED}ctorywizuk.com
• {BLOCKED}itfeldt.dk
• www.{BLOCKED}gfoodie.nl
• {BLOCKED}n.nu
• {BLOCKED}llesiniacademy.org
• {BLOCKED}ni.pe
• {BLOCKED}ecialtyhomeservicesllc.com
• {BLOCKED}certs.digicert.com
• {BLOCKED}acebel.be
• {BLOCKED}eeneyetattoo.com
• {BLOCKED}cleados.com
• {BLOCKED}abattoirs.org
• {BLOCKED}artspeak.com
• {BLOCKED}urnextshoes.com
• www.{BLOCKED}xtshoes.com
• {BLOCKED}bohrmaschinetests.com
• {BLOCKED}rardon.com
• {BLOCKED}auty-guides.com
• {BLOCKED}lbygg.no
• {BLOCKED}und-ansichten.de
• {BLOCKED}rime.com
• {BLOCKED}ie.com
• {BLOCKED}oll.com
• {BLOCKED}arineengineering.com
• {BLOCKED}ue.com
• {BLOCKED}de.com
• {BLOCKED}albrightdds.com
• {BLOCKED}a.nl
• {BLOCKED}nededenroth.dk
• {BLOCKED}ernia-conseil.fr
• {BLOCKED}heiligenstadt.de
• {BLOCKED}slaw-narty.pl
• {BLOCKED}ingmillionaires.net
• {BLOCKED}dstats.com
• {BLOCKED}icalsupportco.com
• {BLOCKED}ttekniksipil.com
• {BLOCKED}tangmarketinggroup.com
• {BLOCKED}rgemuncey.com
• {BLOCKED}netvisual.com
• {BLOCKED}kinn.nl
• {BLOCKED}cjapanart.com
• {BLOCKED}lora.nl
• {BLOCKED}elakevision.com
• {BLOCKED}rl.it
• {BLOCKED}toniatonaggelon.gr
• {BLOCKED}4cdi.com
• {BLOCKED}realuchesi.it
• {BLOCKED}kseymourphotography.co.uk
• {BLOCKED}doctor-durban.com
• {BLOCKED}ksideseniorliving.net
• {BLOCKED}bouwingsdouche.nl
• {BLOCKED}-media.com
• {BLOCKED}centers.com
• {BLOCKED}vidmag.com
• {BLOCKED}emarinefoundation.com
• {BLOCKED}itabeachassociation.com
• {BLOCKED}pinglaforetdetesse.com
• {BLOCKED}prattmediations.com
• www.{BLOCKED}nelemenestrel.com
• {BLOCKED}iro.com.ar
• {BLOCKED}art.com
• {BLOCKED}antra.com
• {BLOCKED}er-place.de
• {BLOCKED}eupetel.fr
• {BLOCKED}x.pro
• {BLOCKED}otruckwreckers.com.au
• {BLOCKED}igas.com
• {BLOCKED}-jjb.fr
• {BLOCKED}ehartman.nl
• {BLOCKED}torvictoria.com
• {BLOCKED}turyvisionglobal.com
• {BLOCKED}scanner.ro
• {BLOCKED}mel-york.com
• {BLOCKED}n.nl
• {BLOCKED}utoradio.de
• {BLOCKED}-elka.ru
• {BLOCKED}nenymus.com
• {BLOCKED}-vita.de
• {BLOCKED}ngletonfinancial.com
• {BLOCKED}ysio-lang.de
• {BLOCKED}ulunkartano.fi
• {BLOCKED}-bap.de
• {BLOCKED}odherbalhealth.com
• {BLOCKED}radigmlandscape.com
• {BLOCKED}lverbird.dk
• {BLOCKED}vbec.com
• {BLOCKED}nksrl.co.za
• {BLOCKED}--80addfr4ahr.dp.ua
• {BLOCKED}yptos72.com
• {BLOCKED}ring.academy
• {BLOCKED}isioninthedesert.com
• {BLOCKED}ddingceremonieswithtim.com
• {BLOCKED}aballoons.com
• {BLOCKED}llegetennis.info
• {BLOCKED}ogeeconseils.fr
• {BLOCKED}tiveterroristwarningcompany.com
• {BLOCKED}tionnewsroom.com
• {BLOCKED}wershell.su
• {BLOCKED}nmccallum.com
• {BLOCKED}tteoruzzaofficial.com
• {BLOCKED}ccesscolony.com.ng
• {BLOCKED}estar.com
• {BLOCKED}ectamarketingdigital.com.br
• {BLOCKED}ntourage.com
• {BLOCKED}sajjongeren.nl
• {BLOCKED}linemarketingsurgery.co.uk
• {BLOCKED}rtbutter.nl
• {BLOCKED}eboardroomafrica.com
• {BLOCKED}andrivingschool.com.au
• {BLOCKED}va.co.uk
• {BLOCKED}acermonticello.com
• {BLOCKED}rseport.com
• {BLOCKED}byard.com
• {BLOCKED}bcon.com
• {BLOCKED}sten-vochtbestrijding.be
• {BLOCKED}lterman.es
• {BLOCKED}eater-lueneburg.de
• {BLOCKED}czytana.com
• {BLOCKED}x-interim-and-projectmanagement.com
• {BLOCKED}b.ch
• {BLOCKED}grinya.net
• {BLOCKED}ggienessa.com
• {BLOCKED}bstomoveamerica.org
• {BLOCKED}pesiberie.com
• {BLOCKED}ergenblaetz.de
• {BLOCKED}vencovka.ru
• {BLOCKED}itkeramika-shop.com.ua
• {BLOCKED}gschools.ng
• {BLOCKED}nuli.com.au
• {BLOCKED}atek-immobilien.de
• {BLOCKED}inlaw-okc.com
• {BLOCKED}olaiamedispa.com
• {BLOCKED}vanced-removals.co.uk
• {BLOCKED}ethinadaydentalimplants.com
• {BLOCKED}boxtherapy.site
• {BLOCKED}er-biznes.com
• {BLOCKED}nnergo.eu
• {BLOCKED}eoflightmusic.com
• {BLOCKED}arttourism.academy
• {BLOCKED}oweb.software
• {BLOCKED}kecrm.com
• {BLOCKED}andambv.nl
• x.{BLOCKED}2.us
• {BLOCKED}centraal.nl
• {BLOCKED}school.ru
• {BLOCKED}graphycreativity.co.uk
• {BLOCKED}bitare.com
• {BLOCKED}y.com
• gratiocafeblog.{BLOCKED}ess.com
• {BLOCKED}a.com.ua
• {BLOCKED}sbaneosteopathic.com.au
• {BLOCKED}rlottelhanna.com
• {BLOCKED}fectgrin.com
• {BLOCKED}fibersan.com
• {BLOCKED}ema.gr
• {BLOCKED}thornsretirement.co.uk
• {BLOCKED}ticmarine.dk
• {BLOCKED}candy.com
• {BLOCKED}iahub.co.nz
• www.{BLOCKED}ub.co.nz
• {BLOCKED}auses.org
• {BLOCKED}urance.com
• {BLOCKED}bs.com
• {BLOCKED}oncrete.com
• www.{BLOCKED}imes.ru
• {BLOCKED}allum.com
• {BLOCKED}la.com
• {BLOCKED}pure-impulse.com
• {BLOCKED}es.com
• {BLOCKED}s.be
• {BLOCKED}t.sk
• {BLOCKED}o.com
• {BLOCKED}amaroofingllc.com
• {BLOCKED}cine.de
• {BLOCKED}u-guides.eu
• {BLOCKED}tenplicht.be
• {BLOCKED}nthacademy.org
• www.{BLOCKED}edeyecare.com
• {BLOCKED}erwork.eu
• {BLOCKED}attswisswatches.ch
• {BLOCKED}empelking.de
• {BLOCKED}steelbuilding.com
• {BLOCKED}twentytwenty.com
• {BLOCKED}katjaya.com
• {BLOCKED}i.co
• {BLOCKED}oepke.eu
• {BLOCKED}n.ru
• {BLOCKED}itale-elite.de
• {BLOCKED}iplan.ru
• {BLOCKED}hi-okna23.ru
• {BLOCKED}fenmattgarage.ch
• {BLOCKED}boundnutrition.co.uk
• {BLOCKED}segaard.dk
• {BLOCKED}zar.com
• www.{BLOCKED}r.com
• {BLOCKED}up.it
• {BLOCKED}ter.com
• {BLOCKED}a.net
• {BLOCKED}monturkiye.com
• {BLOCKED}i.ru
• {BLOCKED}ne.agency
• {BLOCKED}sifer.fr
• {BLOCKED}acare.com
• {BLOCKED}aelfiegel.com
• {BLOCKED}ica.com
• {BLOCKED}mealprep.academy
• {BLOCKED}horlogerie.com
• {BLOCKED}dseeing.net
• www.{BLOCKED}eeing.net
• {BLOCKED}blephotography.com
• {BLOCKED}akilian.de
• {BLOCKED}riskcenter.se
• {BLOCKED}see-buhne11.de
• {BLOCKED}movers.com
• {BLOCKED}nzel.de
• {BLOCKED}nfriedlander.com
• {BLOCKED}ngalegacy.com
• {BLOCKED}o.it
• {BLOCKED}orensics.com
• {BLOCKED}gz.de
• {BLOCKED}lec.com
• {BLOCKED}me.com
• {BLOCKED}e.nl
• {BLOCKED}ai.com
• {BLOCKED}c.org
• {BLOCKED}h.com
• {BLOCKED}hspics.co.uk
• {BLOCKED}t150ans.com
• {BLOCKED}rmusic.nl
• {BLOCKED}i.eus
• {BLOCKED}dloftladders.co.uk
• {BLOCKED}onsultancy.com
• {BLOCKED}azepamblog.com
• {BLOCKED}tusnhlstenden.com
• {BLOCKED}ntidigitali.com
• {BLOCKED}ajosediazdemera.com
• {BLOCKED}koen.com
• {BLOCKED}icompserver.de
• {BLOCKED}ous.com
• {BLOCKED}ggsregisteret.no
• {BLOCKED}astay.com
• {BLOCKED}others.com
• {BLOCKED}linjames.com
• {BLOCKED}ldhendriks.nl
• {BLOCKED}technologies.net
• {BLOCKED}ncretecoatings.com
• {BLOCKED}estschool.org
• {BLOCKED}stitute.org
• {BLOCKED}ographic.com
• {BLOCKED}nswoodblog.com
• www.{BLOCKED}utions.es
• {BLOCKED}acteur.fr
• {BLOCKED}dineroux.com
• {BLOCKED}aint-flour.fr
• {BLOCKED}rental.ae
• {BLOCKED}lics.in
• {BLOCKED}toy.store
• {BLOCKED}pain.com
• {BLOCKED}uckrecords.com
• {BLOCKED}eflybilletter.dk
• {BLOCKED}r-iowa.com
• {BLOCKED}ranch.com
• {BLOCKED}skills.pt
• {BLOCKED}ndingminialbums.com
• {BLOCKED}akers.com
• {BLOCKED}beton.nl
• {BLOCKED}romote.de
• {BLOCKED}e.com
• {BLOCKED}ble.pl
• {BLOCKED}asters.com
• {BLOCKED}urbo.de
• {BLOCKED}surecleaning.com
• {BLOCKED}eek-diet.net
• {BLOCKED}ophilippines.com
• {BLOCKED}diology.com
• {BLOCKED}malo-developpement.fr
• www.{BLOCKED}malo-developpement.fr
• {BLOCKED}makersheerenveen.nl
• {BLOCKED}gandoprogramas.com
• {BLOCKED}alitytrainingsolutions.co.uk
• {BLOCKED}p.com
• {BLOCKED}l.tn
• {BLOCKED}enbepthanhdat.com
• {BLOCKED}demmobil.com.tr
• {BLOCKED}rettyhair.com
• {BLOCKED}thillgroup.com
• {BLOCKED}nimage.ae
• {BLOCKED}toinsurers.net
• {BLOCKED}eenartwalk.org
• {BLOCKED}stone.co.nz
• {BLOCKED}yentuan.com
• {BLOCKED}abrown.com
• {BLOCKED}indonesia.com
• {BLOCKED}enedesigns.com
• {BLOCKED}ptdecor.com

However, as of this writing, the said sites are inaccessible.

Ransomware Routine

This Ransomware appends the following extension to the file name of the encrypted files:

• .{random characters}

It drops the following file(s) as ransom note:

• {encrypted folder}\{random characters}-readme.txt