Ransom.Sodinokibi
ThreatDown is now the name of the Malwarebytes line of business products. References to Malwarebytes below reflect the amazing technology used to first identify the threat.
Short bio
Ransom.Sodinokibi is Malwarebytes’ detection name for a family of Ransomware that targets Windows systems. Ransom.Sodinokibi encrypts important files and asks for a ransom to decrypt them.
Type of infection
Ransom.Sodinokibi is ransomware that encrypts all the files on local drives except for those that are listed in their configuration file. We see Ransom.Sodinokibi being dropped by variants of Trojan.MalPack.GS that previously used to drop Ransom.GandCrab.
Targeted files have the extensions .jpg, .jpeg, .raw, .tif, .png, .bmp, .3dm, .max, .accdb, .db, .mdb, .dwg, .dxf, .cpp, .cs, .h, ,php, .asp, .rb, .java, .aaf, .aep, .aepx, .plb, .prel, .aet, .ppj, .gif, and .psd.
Malicious behavior
The first thing users of affected systems notice is usually the ransom note when the encryption has altready finished. The ransom instructions are visible on the desktop as well.
Aftermath
Without backups, a roll-back system, or other ways to recover the encrypted files, the affected systems are usable, but all the important information stored on them will be inaccessible.
Protection
Malwarebytes Anti-Ransomware blocks Ransom.Sodinokibi
Business remediation
To remove Ransom.Sodinokibi using Malwarebytes business products, follow the instructions below.
Home remediation
- Show Malwarebytes icon in notification area
- Allow users to run a Threat Scan (all threats will be quarantined automatically)
If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Ransom.Sodinokibi with our Breach Remediation tool (MBBR).