General

  • Target

    e5d23a3bb61b99e227bb8cbfc0e7f1e40fea34aac4dcb80acc925cfd7e3d18ec

  • Size

    535KB

  • Sample

    191216-pg5st7zccj

  • MD5

    e713658b666ff04c9863ebecb458f174

  • SHA1

    8b1d4ae7cbc6c0fa0705122b9556745670863214

  • SHA256

    e5d23a3bb61b99e227bb8cbfc0e7f1e40fea34aac4dcb80acc925cfd7e3d18ec

  • SHA512

    0fda0036f8dcd54755ad292e68ba16e2cebd06f208474b38afee94c6b2c0ea1b706cca1303e08c50cbb3b56526502a7bf5764cf17c647844bd9736e06f451d99

Malware Config

Extracted

Path

C:\s0t83-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion s0t83. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B26FD4687496107A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/B26FD4687496107A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wA4KbGRDfha1HS/bY2/flUOQ9zCzAQD+xU5zt9cWUBcyYEBRTu+wqGgLJ53sjfA1 3MO8OcfCtkXKP6gn2TsWSdSAGbTADwru5d9DYF37AV+7aqNwgx8lVExNTFg0G5hN FMXEix+3T92NbYPsiFpMkzy4qeWkgYnSyiIXsKn7E5SmZJkJrd3LjrboUEjywdx/ eVr5N7ySshe59y68a0KX2m9coVBsdICiUn/cqwmhygSc3pGdJ3MC/fJFLh6PNDiM YOhhgxB939erEVj0RM72Kn1kh+6O3JKOfh8XLw6jAOEKnRtu4pvZsM2PJXiRPs+n akkKfwDDPnlPXN4nFYDWGGEscf5dIrXbynpcxvowr/gkVhbp+ln556T+OqjVvQM9 97qOyYk7ikPKTygyEY8bjhStRvfOrAtGcNpXNGqnz8LENxBrrr+01VHNCrt3ATEv GhJFEK6Q6QpoR3S8kN8DgkXhj3zbiEBTfMuk8ihnJUQQW0RogLynjZkmo4Sqy4Hm U0a2WECFM/lCjyefL0SUyVGuoyiqdRMcjXuQGGrFlA1aX5EAfo13eywKF9WM1Y4c MGDqEfCIGQqONZNdxyWQXt+wEF3skYR46teVPL9PDVwyiaJGyN3jP/H0Ir4PgWJ8 jLFEWh/QpbZTZodegE4O9lQg6Ftt5HXXFOWuZy0SLL2Sr0b/Q1xxYjfCpzFTP0uJ ++vFSGUuvUURCQ1s9okOOOoHxvI4GlLvRJZLcAU9kDkEFzNkVACg2LEca7Vgn51b ofcgGtDNX3MhHOhA0jN6ISGzv24Di/VrPSG6otBF1dAh720WEacIplu6p4z6W7co RZP3dAG/L5nMEQRc9LmP59IkTq/hqMWGkXmlEojUmePSqCgwBO6V6neqPV6+uDG0 xqSSKGf2EiRlUWlKCy9Fecl2w2hlo1us1Z5u3MXdV1/RhwG7zb2ppGuS6jG5RT6X oD4zcbyCnHjNK5udiSqn6iJsxR4EXsA/7xIFrBBPkaneb+Xvx3fRLRupF/oET3vm Ke7BTXOz4kGqAS4PEyRfa5brZfvJDsTm72rmazbsWzQWQ2VQF28YsKU8X4vMcWU7 RSRnSnba9w2Wwq4z4vNKMSJWIg2eUjmewOl6Bzn4GV+ZE6eCoha6V5+3OPLRquUH CGfroqUu Extension name: s0t83 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B26FD4687496107A

http://decryptor.top/B26FD4687496107A

Extracted

Path

C:\8602x1c1u-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 8602x1c1u. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9D8D6909BCDF3874 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9D8D6909BCDF3874 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hsHI2+FE+MYt7hrWfos6UicML/O/CTLqllNG6Pna12ju1Da1CX0bSScoxXppqGgF SNz+4qNJi0cP++CfnjwikNn71suDTwyaIqEt9PuLi/FvWAgKIoZnIJz/yw74b5I4 R+D5E27Mfke/lbdme2IdmOMFFijSfhmxqYIc0dTOyz4v/S6/PVWmj5yzRWR0HFcD ken13lM+O9wAALo1NwvpJeL1ii7M/XR22BPNpA+t8UH0lHg5/7xyYAsXeGGRk8n+ TMz0JXzCbzWlUx7Brt3FultusJkC5YN3hkuWRnEKSNSXbPuWAEy7lh7xcGGR9dJ3 161KppnRjU0EHxHmx6QE12KlgBoSzo6y4y3PgnnCGvDk95alD5yqdBvmsUqQxSrZ EbJblvsqKu7bk4iKGcwfEjbOEaxt6n9tubrr1sY/N48NDAZR6TUmd9j6psMeQju2 4goewMZiK+VBYX2JNNy55KxgKoWwlOGDuZHxVo2aVGRYjEnlzdnZKd1/vCA+3/tR +XZcGdeLwe9WxTgNOfXgIQyTDC2LAEjxYfVNRUbfhrs2vzsj2ke4C9921fkKkGQu FquI26vZawebG1Ftbqp1azQQtfyvlwZnazeyeGxPuo1V4f+iyTpeGiaucwFE7lQ6 KPj+hT+2sNW6bZlhRk0B+YArPczb4TSAhYyATspzsk4Ccfn1wTdRxOrrZ5OUBRdJ +rFcdI1DFI6AhB8MWlooOj9MZU31jDZgzkFBBaqDvmkNnKG6cbCKa+NPgyKTytx9 7fxz9yPo+8zsfmLtff5aOGLyIRO58KYAmTV3rrB3j6l/0dHXqZVqf0dEGgy10YLn lOpBmlxaA9vqCBlhGQVFKfCHRA3MqgP4RJqs1uNYlEhldcMkpQDKk6I+pTGf1uzU jVTqhQWmeWOxBiX00BGt1d67nDaUnqLk5Ib8OMmF6vMy15rEGCaNZF2vMvJsbtMf E4byH78UhAxpOlJR77VJ0escssZ76i+ew93j2jY3P/yi1lOv8gpxnG+PMcSPEDa0 0767g/PNFkg0ds7C/ohvEv7QC9R+MkQoysAULr5FDF5Ec8eEggjmV0lcg0Tm2glL g2ZIlV3LyQgULeHi9rjPLDcEk3IyU29bbgRZIBf0xKRQBV6lITHTXYSXqoqwzQ== Extension name: 8602x1c1u ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9D8D6909BCDF3874

http://decryptor.top/9D8D6909BCDF3874

Targets

    • Target

      e5d23a3bb61b99e227bb8cbfc0e7f1e40fea34aac4dcb80acc925cfd7e3d18ec

    • Size

      535KB

    • MD5

      e713658b666ff04c9863ebecb458f174

    • SHA1

      8b1d4ae7cbc6c0fa0705122b9556745670863214

    • SHA256

      e5d23a3bb61b99e227bb8cbfc0e7f1e40fea34aac4dcb80acc925cfd7e3d18ec

    • SHA512

      0fda0036f8dcd54755ad292e68ba16e2cebd06f208474b38afee94c6b2c0ea1b706cca1303e08c50cbb3b56526502a7bf5764cf17c647844bd9736e06f451d99

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality

    • Deletes shadow copies

    • Windows security modification

    • Discovering connected drives

    • Modifies system certificate store

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

1
T1107

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks