Resubmissions

02-12-2019 10:20

191202-k7xrts92dx 10

14-11-2019 15:55

191114-lrhkzccm9n 0

General

  • Target

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • Size

    157KB

  • Sample

    191114-lrhkzccm9n

  • MD5

    b488bdeeaeda94a273e4746db0082841

  • SHA1

    5dac89d5ecc2794b3fc084416a78c965c2be0d2a

  • SHA256

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • SHA512

    2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284

Malware Config

Extracted

Path

C:\Recovery\3bo60i97w8.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 3bo60i97w8 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4AD8367D582FAEE3 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/4AD8367D582FAEE3 Page will ask you for the key, here it is: 15BBxHh3rVOr+usprG4jnxYyRoBigRmZLlwUhoXUyA8s9xWg2ynhVsfCD1YYMmkF IIVQ9fwv5JPvJhmX01+c3BQWL8UcIaY9UpjcBZA9kzR2q8fcvk4xKh3O7kd+b1Xs pG1NpSUfeL9BRkvcp4OH/v92A7A/c6MHg5Pq7sCXI941NnnUZC7iW9euAwsR0/wY xlv5Uh/PnPepsxKNXDcC9URmW1h/WrCrMIyrzRpmJjSyvIAnR2Nf9kOaL8gqZSv4 noVj9urb2OJtKsKNa8MnnnpA4jyJTNExtmGjpBrqEJzRULoInuSRcmaa9DByk0IT j7XRkEkx3Fzz4Q7l/UlHPQVu1zjlybbSVFsdbNQBOBl5RqkNQjamskOhrN9aV+H6 EWu2UZx9USZJMemY7v639S2P0Vei4K+HGbm1vCDmbq6IRnk22SVwZGDFdrgy6Dot M+2yY0ozKwdFjR88SsmYCJaefkZvzg973k9X7bvQq+EWquWcmuA++hkRmp5bujw4 p5vhvNnvOzUnu7xVYiz+KfIUgh0Zq6BsYQhPykVRswlZ4ruLMHakaQvQJpn2Xzi0 TOU+fnFYiVtlsRUe7hG2ZRTMgP4Ccdtm91pd5JhsYwtQG1g9UtPD1KSBxItUJhkA 4btSz/C5LwGd7KpTxJjeXVkOi6rhW8O6V69Knr8k/SrGvAb0G5wR2CfIbGc5SvqM QjV9ZGluCxA87IioiPRy9YB7FCg5upgqbZlDAr+RdJ8LXP9jqv+dmwN/0DC+hhkZ 9U0t5Sckl9VQpZFQR4TCXQLTfq0R6shfMAJ0mRMqSHAdQgqVchUSWZkDda/81RQN lX5NNRm1nCu6Ozm7vtt3zaJvs4BVuIbXemhOrOsCwOE+fbyHMkWsjBp9QCK8az9b nQcMgTuJoLp2i16f35D0IymKWhNWUVcu/jRYtvGQKxY8yH5jyNpx6yjGhCrU1NoP KoPiC+okh+0lxiL4/bDn02+9eNRw2CeqNL/IT8ZRRxtEZHxXGekAXPmZqNh8krb1 DrYOs33PrtzyIqaZmd9vdnL4iDxuoBZOWHaN0OjwlZR2ucpkpky2UUPh0G4VkLQj nbtIIK20PG9JqokbwGD9CfMVbB4Y53/C
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4AD8367D582FAEE3

http://decryptor.top/4AD8367D582FAEE3

Extracted

Path

C:\odt\629yumz1.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 629yumz1 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBAFD39AEE599D15 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/BBAFD39AEE599D15 Page will ask you for the key, here it is: XVX2lDsNsXtb3QL5mIOYHzgA2Kqy4h/W48xpNNHdIEfdqiLtCJdv+wkQjkgVZC63 K3M7E/XssfvB98LJ2B2hFY+7oHgFLNyfTx6BNEjeuWlIprOgtvJZTfgE8tXayAWs tFFebweby/UVxnVgp01zqn9aW8fGsEXDMhms+/hHYoCs+g1QLUhFZ9N4nmSjpHm8 z4B7wmLWu/3MuyDvzTnAA7Wel3eWhPz2UCs0kVOjsNQg60RSNfstiUsUFy7Y9ax3 02PL7dXWfINOvppJD+cUP102sD+Lf29QI1c2Vp0j2AfR8sqXJbW+MK/g6VDiQSJi FjkjPbUTTYwr6rQ+icpEV3cqoK5MgbsgTZekicm1UOyCu8fV8WbzdtfSeuZc5MuB vwjFY7+o0SRdRBOGcWiHPWSXjSkxG6EFzxDuAd3MlcLkxQmy2WeX919uE3n1sWzh dE71Vq4k/X4IZ2XD85DglDV0MjN2UoJSgYl+EquirF7/D3glqca5D+3O19ayTQeG 9RHFi187NPxGjxl607QwUFkkIIZ7Pw317sqXZzJKIALyxi1Hs4BeRu6dc/ncHMt5 Ggr0fkWgH/r06mVjSCwPh+YcNvaqEG1oLbm9CrAnplpP8aWHigk9fjET1wjDgN2W e5WWupMbRl8n9c6JikHrIjWCe3cQOdR3b30HZ9QENfKmKeS4M9jVTKfry+ixK5J7 gkJzkhvqWK5LU2gJEur0n3dMubww5/9aaqwjfJqmHV21h4V8D3tJ7fcozjE7kQ1G XboVt6wMQFIjf448lxbbKkkqMO1yKqivyDxJeKEgH0c6HRYMaZMFdo9lrMSRMDgm yqLcKZXjQZXPTtFZ71BV+nsAp6Jkn5ViI8o3qhARKCDCLnMgS9hMeIthKLV4QNie T//PQKjfT0QaEkkehqbGq6Y6cq4Wp6SSDbkGyV6qi9/vD8OLG7dGsBK2BZyqGYhB pl0obeKX2nfQ/jsP821D2mfMb63o06WlsSEzj7LYc0ZPspO3JFJTygqClJpEFpBG pLjGC1Jxm84YnRj/OSJobh0O132bewf39cWTq8vhI+9CQ4VvRT/twPrmvDRrdAb/ US+RYmGqCbo=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBAFD39AEE599D15

http://decryptor.top/BBAFD39AEE599D15

Targets

MITRE ATT&CK Enterprise v6

Tasks