General

  • Target

    74bc2f9a81ad2cc609b7730dbabb146506f58244e5e655cbb42044913384a6ac.exe

  • Size

    667KB

  • Sample

    191209-5gbby7dm12

  • MD5

    48a673157da3940244ce0dfb3ecb58e9

  • SHA1

    f69f954699eaabec17a0157ed3503e7ee2ae8474

  • SHA256

    74bc2f9a81ad2cc609b7730dbabb146506f58244e5e655cbb42044913384a6ac

  • SHA512

    e0d7714f4dfd2b99a6b3cc787839fcb5b898615cf5de6384d71f64758f21fcb46dbece321973a3f93412b870c4b23295aa240067aec3c87405c7887c5e9cedb5

Malware Config

Extracted

Path

C:\Recovery\r79rrm-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got r79rrm extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BF11B64AF0992ACD Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/BF11B64AF0992ACD Page will ask you for the key, here it is: EpaHPpziuhud5akAau5Va5wrGrsKgJbrUuNVQXyD7DuThnb1qeM+u/CxWxzmbJJO 8VEpeiU+93fhUYa7MEuK2NgUd0IKlOmZe76wmmm0ApxnVBKyv8UmTg6KVhcDp4nd RPzJu9MPl4VnFM2j8+s7OrQ87smJ3nq5cID8Bcaj+j/fp4xDRaDK7Lb0KX01Oulp 15xcIuP414se8ACLgtdMmnINdsA8MR9xyb/zNrlM1ypeL2QzN6P0P6ZYQ05bGADe +tUCHWDHD16O+jJ+Yg+zjBbw1qTNW1ZYsTN1cOcGq+N83ObW3ygJLSJEwi8y2m62 xHigVNnzwhVjgMcdXUf2r+LOZ6G4L8Ab/UYqQ/25VZfzAXTBEdtPYY756T88F1/I BNX+eX7UAlCetqg2w+f6aO7lCNVTeZtcOI4GcmhtZm1jx3f+O4Xi3i6AGE5Zh3Ur VfsHyjzOlvxe0jOtKpYiMy2JnUr3ergRn5dJiZFDjlYUhII0v5V6dC706Lo7WU18 oetgZuhiU//bhDlLQXAdjHVzh0upoiIJjFT7oCh9p/aBPj1bY9+dsklotAEtox3w 8gSH85p+3fLLr+qqfdQGaS59lEaEShGwqrC6uj7ajuChooQ7ZC1P6YQ/bGK8s0bN y32IBC84N/sBB4TdPhh7JCDBiHwWdfh71iwMpaSf86HjK922jZ2dg8VkUJM4qzac PgmMn2KYHgi1YhKT4bIdvZUqar7lV4aka3NrIgmcoXb2RU+ykblCnVp4fIpKKEtW 9ZDetzPJH7TOoQNPROC0Yz9bil9oX4hmlqzLS6VuQbcszulhPebpIW/WxhP/h6sW z7g2zUbUj8mdEczj/uV1iRDCy6L3VOu/MtEceQlcOdloDKM0Po59e3uk9llS2O3X aGHtCAw09WLCai5LV2AZIwE6tIJcS1wHQSod6PS4QfYWsg35YH6nc3dY34Md9tyZ WF46g7IxwViGGl9s/N70w0at/FNHu+6/cjcPMleWNqlvxJ+rKyvyhkdDToKRcBNP RA2hb9Fzj1weoJcBghRZ1DdbjJG+C8iNpktDgycRmA9WVfUVz91eGiOUJclGxysc LzbSsAv4TNBSXzSqO/iwRfkLmCt0iw==
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BF11B64AF0992ACD

http://decryptor.top/BF11B64AF0992ACD

Extracted

Path

C:\odt\ufb125ez-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got ufb125ez extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/63D19F775FDBEFBB Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/63D19F775FDBEFBB Page will ask you for the key, here it is: RB4CDaV1up1wXlrfbEdj+BOPzVBTdqVAoPEkzqol6RUe57e/4Pwn0RkcSlBrOSWI kmobrR4n43tWdfvEtF2ysUz3roaYhyrQkIYU61SIChtKzS/4pbY/wQjoNfrtPErl zf5SZFkRCM6mG4YkG2KI3Bgew0HsMh2cTwe5bsKeZra+tjW0vQWuHYGp1/9x6ecd 2fJERfmwllXlCRJDYpfW5v3dQxv5sAlJWaRCvIbnMsydA2jTCVHI8YB6XxluH4BY Gw6aoYLqULyeQWW+BBbDYrNIHOay9TydHhZbJ2+vBPjSmHHZ7/0BVIZC4aUVe4wu J+XcGb+1FMjoYLvj181tblEyr0RpoHsVe3HGNo5TA9D/nJI3kCXpDu1L9uGseh/L 1XXBsgExTPFHfi3SA1fmIHjBXoWYrEhoTV80tlXKurgPp7ztaiczLbKSvTm4gNoR 9p5uizpNTwMX9Ru1TQCd2Gul+dHIJnlezRnhZND+HQ/xi/mP/yELXOHZVb8xeSUJ B2QS6ADj1y8klt/TRdopAYacaQwr4ZOLNwTRcy3OH7WwmRFG9+sz8pGNi3xnnpEz tlh/7g3hWXSKpLEgpJxe9O6J3+qY57gSzZGLp0XsHiF5+VbkOjBafdSnrcg8dsH7 ahR/Kl5CdhumyL35xKyyzjheTrCwsXDnb+yZOhTFZOCsIKg+wCzcivm2AZ9RJruu HIlGCbrvYRbmK/yKPbM83D362NlAsl6BdEBqv1xSezxD+qyaDQfL1Q367O/aE9X5 n8cKK455B0FRH89KJIn2ei56Roae1VuQRMrohMOKzyqqsKHf7YV1SXNzPMOwuuqx j5lJpWiX0FERtRMBu7Caouu3aAbUKTj0cjqT26RGy2TKyM+1x7lWppS9gbxMTG3B v5tTupR8laagk3KjvF7eFD5ngo7N42cEfBuG0ErBUtEkvJsU4/A3H/UZ4UVtC7IV 4NEHDJsU1AJaVO4UjQrB8IDuaAn/ZbfiyjhGScMfgKWcpSEfEqHLzT42AlcLYM5y 14XSwVFabNT+XPJrhgnH2X8Jyf+IlhMMAb79uF3JATPJPZmwcx0iA0zOYZ2AVrdw pS6EXwjv
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/63D19F775FDBEFBB

http://decryptor.top/63D19F775FDBEFBB

Targets

    • Target

      74bc2f9a81ad2cc609b7730dbabb146506f58244e5e655cbb42044913384a6ac.exe

    • Size

      667KB

    • MD5

      48a673157da3940244ce0dfb3ecb58e9

    • SHA1

      f69f954699eaabec17a0157ed3503e7ee2ae8474

    • SHA256

      74bc2f9a81ad2cc609b7730dbabb146506f58244e5e655cbb42044913384a6ac

    • SHA512

      e0d7714f4dfd2b99a6b3cc787839fcb5b898615cf5de6384d71f64758f21fcb46dbece321973a3f93412b870c4b23295aa240067aec3c87405c7887c5e9cedb5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Deletes shadow copies

    • Windows security modification

    • Discovering connected drives

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks