Ransom.Sodinokibi is Malwarebytes’ detection name for a family of Ransomware that targets Windows systems. Ransom.Sodinokibi encrypts important files and asks for a ransom to decrypt them.
The first thing users of affected systems notice is usually the ransom note when the encryption has altready finished. The ransom instructions are visible on the desktop as well.
Type and source of infection
Ransom.Sodinokibi is ransomware that encrypts all the files on local drives except for those that are listed in their configuration file.
We see Ransom.Sodinokibi being dropped by variants of Trojan.MalPack.GS that previously used to drop Ransom.GandCrab.
Targeted files have the extensions .jpg, .jpeg, .raw, .tif, .png, .bmp, .3dm, .max, .accdb, .db, .mdb, .dwg, .dxf, .cpp, .cs, .h, ,php, .asp, .rb, .java, .aaf, .aep, .aepx, .plb, .prel, .aet, .ppj, .gif, and .psd.
Without backups, a roll-back system, or other ways to recover the encrypted files, the affected systems are usable, but all the important information stored on them will be inaccessible.
Malwarebytes protects users from Ransom.Sodinokibi by using real-time protection and Anti-Ransomware signature-less technology which monitors file system activity of processes against a certain subset of data files in specific locations on the endpoint.
To remove Ransom.Sodinokibi using Malwarebytes business products, follow the instructions below.
How to remove Ransom.Sodinokibi with Malwarebytes Endpoint Protection
- Go to the Malwarebytes Cloud console.
- To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
- Under Endpoint Interface Options, turn ON:
- Show Malwarebytes icon in notification area
- Allow users to run a Threat Scan (all threats will be quarantined automatically)
If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Ransom.Sodinokibi with our Breach Remediation tool (MBBR).
- Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
- Open your Cloud console.
- From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
- Unzip the package.
- Access a Windows command line prompt and issue the following commands:
mbbr register –key:<prodkey>
Note: You must substitute your license key for <prodkey>.
- Copy the MBBR folder to a flash drive.
- From an infected, offline machine, copy the MBBR folder from the flash drive.
- Start a scan using the following command:
mbbr scan –full –ark –remove –noreboot
- Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.
How to remove Ransom.Sodinokibi with Malwarebytes Endpoint Security
You can use Malwarebytes Anti-Malware v1.80, which is included in your Malwarebytes Endpoint Security deployment to scan and remove Ransom.Sodinokibi.
- Remove the infected endpoint from the network.
- On the infected machine, right click the system tray icon and click on Start Scanner.
- Select Perform full scan.
- Click on Scan button.
- Open CMD
- CD to C:\Program Files (x86)\Malwarebytes’ Anti-Malware
- Run mbamapi /scan –full –remove -reboot
Malwarebytes can detect and remove Ransom.Sodinokibi without further user interaction.
- Please download Malwarebytes to your desktop.
- Double-click MBSetup.exe and follow the prompts to install the program.
- When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
- Click on the Get started button.
- Click Scan to start a Threat Scan.
- Click Quarantine to remove the found threats.
- Reboot the system if prompted to complete the removal process.
Take note, however, that removing this ransomware does not decrypt your files. You can only get your files back from backups you made before the infection happened.
File hashes (SHA-256):
*****-readme.txt (where ****** are 5-8 randomized characters)
The information contained in this website is for general information purposes only. The information is gathered from malwarebytes, while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk. Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them. Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.