General

  • Target

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • Size

    157KB

  • Sample

    191210-ne9dsbbgj2

  • MD5

    b488bdeeaeda94a273e4746db0082841

  • SHA1

    5dac89d5ecc2794b3fc084416a78c965c2be0d2a

  • SHA256

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

  • SHA512

    2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284

Malware Config

Extracted

Path

C:\Recovery\8be9iaj1q4.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 8be9iaj1q4 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BAD4040FE6406E97 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/BAD4040FE6406E97 Page will ask you for the key, here it is: eZia+ZnZhHS7WG8Hbtuj/+bnMG2es50TmTPM5F6OCvajKaEe+s6z9DQBS7B0ikHx ZkFpKKE178SZIU7LVPMMWDCbLynHp+UxmPPZRlF24VNCwPwVWeLK2zzXyesCU9Fg E76Xnr4WHCywU4GGis3GZRmduJPwxH1X+gRpdAti5CXaodWYoRAFydZchMYC2t2C Nh6Z8hT1sclF+ZWQ4s63TA8aRjUmhkGiHFwCVYjLSTl8h2pxHrWKcsvEezp2Xqdf FCowivMex0pZw+SNeeNRm4GryhemaXSWnnHwSQwFFTnauQE+77NEWzX5ypT1nOf2 Aod2gZnGP72JSKuKZAS3278q1noLtaZmEazEMqof9XMn94KxBY5ofPAP3srPdrs2 Kr6Qat20rFNs1lNWU7UNU0vx98dOhZmDkwGc9yNthwhKKROlvyBv7vzunkOMbXUi YP5i66MpqYZeTyMguaXBCLki3X7CGqJ/JIc2vE4FPzTc8C58ogX3CqlbBGLtNGEd AKsIsOQvo/dzH964gyNdDXcZybtyN6StKet+UhMR12fUaMQOf9oNVuucNJjgR7hT tLOPsfwA70QOm4kNZnodIM5GsGfQAex4SFvu7kCibjsENyzUpl1oSrDevH//HSRc IxAvfOs+T4YXpELIpvhcgWtc/E08I+k7lUYPCldUO3uUuonBs4rFSgNBZRI5tfO/ B+jqp/57bilo5x0bR7Zz5KSKlfOGHUH2FTTZas2Ed6lHOHaqPMgMSOV5NZiK6YI6 TGbVVeewr7ZQxtP5wtd+MsislV6TQ7Fa6PJXkklX86Sc1gkgvwbCSSZ7rPACCjWV PpWvnGVTlYZ6Ncyp66QtKXXQvpPoqT/9q+RYJNwF3J5oW2RGTTuP6QDmZSjehPbB t+UU9neXdUPhPxzx64C4mph8N+ixsIjVs1l7zqKMeNv4WKHnZ/LevOHvljL67GQm 3b/rLUjMDaXD530C4Ph4X7TJm4Fg6byyjhpGEK7VP0wu+2lipXnaWVbiyghQayEK Ti+3zPc8xm/wg/9AJguxI29w8tM2TskKHFHl8I6LGVcYNQT09zc7otqkrPlN3uDk CMSnLPj6x7FNqu7povpICRBovlRG5izr
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BAD4040FE6406E97

http://decryptor.top/BAD4040FE6406E97

Extracted

Path

C:\odt\ia7txw90.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got ia7txw90 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FE0C29C537756C48 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/FE0C29C537756C48 Page will ask you for the key, here it is: Un9lMg+UnPQuM1Ap54fW8uZRJ9UQ71S9x5k36psZ4SwbMf7SyaU37/b53hxoRU0i F+NUpDAa2MIkjT9qWuAX0XadXCbzrjjDN+fOhHbdAv3rxuMDF4pOmkO8Xt/OT9bP figkCsrp6ymQXXvUWYh8CtRJaPTSuMutG/sbMP3s+rG/l5kuMNZx8Ir9c60soGVa 0njlTAG6aOIv1W7eoKQOLVXmVI9rd3PB+HK56GjAO5aBQveO74KKwORDicMoLKIh 8EleYTA/ACRZHgD9T+1sioY/hVbVYt5Tz2Dz9wGT848uivogmWIXnLT6CncS50wG asreU2DMsOM1jmDI/Ue9RLIYF2+phIur+1QinjwslIBendYtGmShkn21Etj0lZzI F9zzxo3VoIbSvRRK9oA/gEGBcFEepu5Qsk7VUxkWG/zPRAvnDP3pdPUFIvGa1mP4 h5Jos2avNZgUbBI5XfCfcpMn72WEWX3SmYULHHHXWzsjOIAJ7Dp64Dy0m8Zlf5fn HYzDuzZlSilVyxBr52Hzjm18nTjirSych5uYXMwQMtlxzThr+zZ4B1TUqAcPb7TK nlAWJoJtNvjqVhanLn5jT/9mZTK9erBIbWTmZoYP7cS8tK3ezN/pVAq66RZ7q4IX o0myhgih5G6qi9XwAwGoGJaVkyrt++nw+lIAoceQatrgshpx/YSOkMlfG89d2wik bIf16RhREtNGFS4ljbBeWE+6nsm3pAfqpgHaZT0yZrwVENyrQzmF6vozFap7FY2G CmTMWFYpCAOKJtntrJ9hD8fEH5A8cSmRC3HiOcqBL/jAVnN1nKcpsBqKhQj6Wo3N Gie1SR/3Tc9CRYEHeXG2bDeHaeXyLE0/BZKANC182eTbk1Ionhl0jBegZLM+HqJC bKq1Uuhqcip+xBpMj4Y3JipEVaErNRsO5JlaYYSquG8eJi7jxdbzgIZxJkfU7O5Z pQgi6TAIA7P6DDaBl0HOREyJpzwYugy5puHoRZfCwpYSceRDqRz8BUvFt5NTRHJg 9iemA1lvFFsjGFqoksSvr0851NWXyfiPKL5ucNxV1guo67BQq4hkB7yYl/7293L0 mQv0PnomUbY=
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FE0C29C537756C48

http://decryptor.top/FE0C29C537756C48

Targets

    • Target

      139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

    • Size

      157KB

    • MD5

      b488bdeeaeda94a273e4746db0082841

    • SHA1

      5dac89d5ecc2794b3fc084416a78c965c2be0d2a

    • SHA256

      139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

    • SHA512

      2b62f0e0b017ed3d2dc7103d2020604f15f95449ba842bba18f886f9e1dcc977c459c53d1e6e7abfe6b99fc3dde24f5cc7a848c92443d1daf3574ef6f0263284

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Deletes shadow copies

    • Windows security modification

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks