Resubmissions

04-12-2019 13:21

191204-vcj2bx45de 10

02-12-2019 16:56

191202-4g8res8d2s 10

General

  • Target

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • Size

    157KB

  • Sample

    191204-vcj2bx45de

  • MD5

    b488bdeeaeda94a273e4746db0082841

  • SHA1

    5dac89d5ecc2794b3fc084416a78c965c2be0d2a

  • SHA256

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • SHA512

    2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284

Malware Config

Extracted

Path

C:\Recovery\33i635v.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 33i635v extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/041FB4C15C08312C Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/041FB4C15C08312C Page will ask you for the key, here it is: DByHkA6zRNGldYSstzeqXLrL51yCOEN/03viHRWdoscO65+DBlsUvgi8CR05QLlj paqm9ZcYRhqUQhtEHhARTXH5Iy/I90MUxduGhoc9V0GpRMga4LVFcaTJmKliqVlw 63/ZEymlOPTlHNdjYBmIMVHcluBQVKai51liYtBvMbg8T7XBtDz/jggXr4QkNNWn GyLsxkLiKFalQA5wc7reyf3ZE5DlOS8e1QpokHiqQ7r67VhL0p7yh0e5QWg0YvDh a+ABmY8WrrIZ3NuYVZjjqshLXoKf8RXvH8/yELC/y2w0QVMFDZPJY6LIneFEKEx5 HGrfDyeHws/JS4tg7acdSKw0lJejAd9bDExUWzYFjV6YMxagBwmVFTY1yBIWoZl6 /qOUWzj+dL9P7oYsEjX5aHkaWALe2JBmfqNut/BYghgKh0t9vL1OsQ5fFS/ZXGwj xFWgdQTMYQMkqhgMZie7L4ssu59/p4ne/wQptiOKbxvDJttZLI89sc0gJ3CvNljq NW/TyGXFMsmznlksNjka0IkwwTysyi1yR9SEgV5sErlLtisTZPuUM4tVyS5el7Wg iIosTe5kplRi2aeQT8fI4pKYTZJxL50frbIHzYnOGm4erV6vXj4jPw9+22epKfLN p5EX1YSvRhBGR0fknWtdHd7kC4ka7S4HPtUefF0rXAOTrvdgnEu+JKteDBcJ6hjF JPtvfWFixLcNLfuISx4xfaGyz8E5nsJTHFOnUAYevSEP+SMgpUJIEv+uVQ1Lcy2R BN8zmGraFYH9NwbSVK1i+YLqQHKWLKHMyQM/OL8rD5dStazo1chyLXxGuIpeVcEH SXVXnLmRb14jXMmOGlMJeoC2dy7F1njFBWQkTUGURwZgvMEHftPvBueRdFIwKfWw FxLTvKD7hUYlvhNQ6qGkxlIa+69ufhzKXdwbFtpEl8CJ48Yh0fWWVmPViGx+Fykg /oSEQ2kv0NQKAJM2l6/d/HI/Z9fd8L/jT9JxDR79e8S4psIO7Wauz3dFskrd5rGE SvoD/VtscY1wlA/wLaiK2ihyF4TUEjTCwxaCpDxjiipFMqxOnt7SDNQsuSjt0jkc hYfmOUo9r5QkZUVudgPGYaTbyPsNQs+V
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/041FB4C15C08312C

http://decryptor.top/041FB4C15C08312C

Extracted

Path

C:\odt\2td919.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 2td919 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1C5D8262147BDE4C Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/1C5D8262147BDE4C Page will ask you for the key, here it is: JGO26xMFmCBYXQD+Kh72jUTgxVSF7mH2ICiJ3owbSA6tKXtPcc4sh4q7oaXk6iRY NjbN6yzFmHo4Aw9kk1fWE3iJDV1EngYGhVvajZoqOOsbzhKmnBtIrHdYT5Vb2blU fj9mHs1EI4cPuvwb9MH5QBMxLbxttVpsIJUqVjHpLL/BSaSPL5/iKsE5JiGyl8/G I5visLM4JglAjbaI5hPZv/Sl4RvGUsIQvZ4dfGrbofz0awzvnTMVuvuhEShjTKlG Ol0RmQg6JoBwG07WcjWqBFn1kD7T7Wzy8uRWwx/RRPQGAkiiAlj/3d+TjkMqGPV6 xDPuLNX9RDLS8qf3UNk3aDFRD0GdNj4ld+hatdhGVYd5CUYKDNiLerZJ0+s8EFCe xTYhzuDS7liHKGzUuwrPQI9M24GIWKPvrtNOzX2cQuZaARQ7oX7bpSoaZWiGXYEd vqfQKKKSOGkGhcKoQLDFQ3y5g8Sh/uXP0XvOZ3DhQdq8ibsNk+0N8kdjf/Hz5wNp 2IUkDaTw4nW9zv/3E50qY2qY0kp6S5zrn9CR4//LDJaYeiuwt5xyoN2rM4vhuL5+ z/IcoIqsoFsaPyLA0WSannFqsN108LvcYVMKcYwxsXaH57bIcWc2iByPPqcnAb1b 5OT08sPbd06P2RytOcNyUF04By+UZpi8u8ag+UOIlVQIrIFc1MD9+UXE1OWk6i3D kmx0rAdV3kxz6waF24gti3U5Z9lTWecUOxcmjmnBXZZTUJUSKV0zeLJVl7vpC81X pVTwxv5yyQuYpd1EX34EtBoajUEG6166jtMMilc0OnlXAMrIXYobpxBM03w+GJCD 3hBKCzN55FPrMpZyTVN0msDImMoJjEI1oOO0mbcXC5GAYTkLey7GMgrl1tyYjhby LR7x6dPHIppSYqlKrG7UexX6xKs6t6b0Qy1CXn3egQxFxkSHz4RZ5T83JhMzPdje 8+L2Zzb8HFuiMLY/iHpOL2wN/DGt5beUwJheFPcm+3fTn2qd6DO0DBXwPwmqP6bJ +lXpZa28O9vYjeDcs7Ju3ABJRZtFsdA5V3OQO3SbhoaADK8H+Bj4iOHTTOna61cS Sb2SIuk74Bc=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1C5D8262147BDE4C

http://decryptor.top/1C5D8262147BDE4C

Targets

    • Target

      139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

    • Size

      157KB

    • MD5

      b488bdeeaeda94a273e4746db0082841

    • SHA1

      5dac89d5ecc2794b3fc084416a78c965c2be0d2a

    • SHA256

      139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

    • SHA512

      2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Deletes shadow copies

    • Windows security modification

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks