General

  • Target

    fast_gas.exe

  • Size

    164KB

  • Sample

    200102-xjawzexxnn

  • MD5

    588efcb1febe347a30e5884ca3f57a4d

  • SHA1

    4ab8d669eff1d76e5626a26afd500dee2432b5cc

  • SHA256

    f4afe7132798deb7f231018b513af2284ed549d3e14b46e8b1190b4b9c1b5f18

  • SHA512

    7eb6535160daae7ad2ed455e1826a006efe478c968a08c09b28ff826c26bf9fb36341af8753f1fbfb8dd48201fa1b8911e7ff8e1dbbdc213d8b2c56f267090f7

Malware Config

Extracted

Path

C:\05t575okud-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 05t575okud. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/03460156E7C74522 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/03460156E7C74522 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7HG4i6awJsjXyaFrTJq2NdShf0LZUw9fwkxSjqTOyo0HnRx2S4BvCSxtbZH0De4a 1Bckmyf6M/xFXHhsPf6yreLX5H927crfTfJ/Yqi4wpcg6rWHNhiXSW2EO7dbEk7+ 6VYaD8YQdwl1qpiG9bdr07+aa2thLOWWxbkH3dmrSvIXymcgGChQHl5nwNH+ts69 hqLWYx2cyUAmWTssfjXSV+VjXKp1QRNP1yvbVQ2yOK4iL0e1NF5bKfQd53aSHVEE snr+ZpdMDQdjZEkcFVeRiq3BdYlg2geVNj1tZ6/unZGLOXpAYUIV6Nz7zp73Pujl UJdM4yA4L8qGTrSn11f1VSLZuiN+y+ZJSm/5hZ43Q87xGQAuHQJwPA+HwNuBZNy0 CTTPxR1I8rD2pabCK4QQ1IDq0D8/b/QVlLGsSdWcwU872JWWwk5p0QHjsZuqDfeb M5Iy2b9U1VtI58yrHISqpWLIzFKXfYbNPkB6HOqSRxkhGr2+XzCE9cMFsg7ZOClK Z3G3WhjAfDl/FWXwpaB9N/umiMYyPDnECZbmWRCZtirsdofYPnC6Zfc7UrVXjGxb unnBF7q8/Y5+qhQaE2uxszG/GRtMVnHk4inVK9SDpiQhqaCj6eFf4gUCEJwq/W5I iu0bcnoAs8e8FIaJgo4h9dK0SjAkCNKX4hw5C3jGctI2Yqd5Mmr09lzqRTf2Y3Dx HP0zv7vrB3kLhbFVxJI5E1Ov0iBni9JlIgrGTYNY/jRZGNxhduMh+vfoh+NGXF2s akrmDXo+Honx5tlbRn+oaC1j3OJCHwKh/v3xUM5sLtBwjEWQzpIzZGKhSBalFZEh dDNB36v7HEGtiNjrkpEEhYatZVDkXntjZYuhT9Q5ccAXzR6II/CJWOX+YpPByv13 vjH2sAczwErpO5cmduTXoQMMWz3KsqYKnB2Cue2XY7y1yMu52XhNpKLR62xyYkvg 0eU3UoUG8VCevQvK/iHtdMtWvtDMUTf8ETvDzSMQrvT8zX/PFS2drWsS2wySc3Wy ceZSwIZaA4xxZsnjpB2W87k1DqZHTIcg/MDufD5gVccwN3kXeazwxlfZywKUodY3 +Eo+od2fFhUAXE7eeR9TuqAzdZVQn7R5w2C9xMuYWZ0IlvIJo2+MZxw6s3AyiOJ2 atRQxv/bCWuBmJ1YJiy4E5wtKy8= Extension name: 05t575okud ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/03460156E7C74522

http://decryptor.top/03460156E7C74522

Extracted

Path

C:\0w835r1erf-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 0w835r1erf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BCFA73F317FB2A2B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/BCFA73F317FB2A2B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 97VTi++bAM59ScVRoTG2YP7y9Qu0D5RxOZWuFGw1hFwNWfxuAa9Ra604D808YpxS zUVbHvY/TO+YDJ5KQ/BVtWRDRvE+w4+SWJcz2tkPOWbPYY7KX/VjOoZHGCK0JGro UTbO3bUdNFtxvj+/VDVTLZ1+fOVUSeBoQbZL2SHoCwc3kfGqnHtggZfrBwAWNz5l +Y7UIT3IX2zi/IV+PjWwlXA1ntj6Oti0/7Epc0T1Up06Z3Ql07I8cfmWw3PCLNjq 7gz99BpW2FFnKVezwyxeNi93PFzUPVSFI3bI7SG2oQmbwZluatGSU6XBKNnwr4bw YCIGV6ROpmMEpwv4eLU0mrjRt9tIlGAth8jfYoP0+xGlMoD+/4wlyO0MPbNnAoV3 b8W9Uxbbd2op6CXvw6gJff5xle1Ro2BvRhargTMkzoWNfrDeb347UCQFadNind5e cHNYOKQ9cS4wk37OwiyT3HXBEPGlNQ4GSeYyWUaNjy6dAW472DlIKshaoBRXwZdQ 7eWh0LoKc5oGA24pp42rWyc5DxvRvqT416SfdlGSz70NblA13j06kyIn6tTjq50X EZPyUbo3BxiMWxJ1K3mGb+XPlg5EMi0lkFzqioYm/JG4/BgcmiGHQARtcWBT13An EEmk308OdoK4TIEzhoV/U0krob2t5+Mrdm5LcASxwJsjl2Vi4vFyDsVVhgbZkIux OigqMGff34b/F4xc7ZKYKFKK6eMWtGyqQSYL16k8IkOTCQgr6luwyhs8oIPh7Wrt MaUmAAsROh4bTcsUvJXHXjhyY4GwgPpYUW/uqBEumBvuK4zq1G6GklKMjFylgyBi v8PrGw089BtISbLkGIoq1JTJdYCtlRcTbxGQhcpdjaRwBBFAe2uYq+FYXUTn/DmW dlWQdY/hPX8LCtEZ/MZLv0DMGCKr6wJvIoxdtUS+Y8nh0U4f6U67yJ3FAj8Yuv39 ZtFlK7AZ4GI+dwy9+LGZKvBGOlXt48p/a6nmvw5mW7kqelEpGmnO8uucq3aCBitj TbVlhqtuQRXLAMPK59c71ttYRtYXMPFZol7DpuNA5hu7PQiOJVQZr99cC6NrWV4h zqun0a38HIqckdt430T9Hc/JDkM350U8xBGkHBf31m57gPsVrkTXUnv3X7bC2vBy V2DtOw== Extension name: 0w835r1erf ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BCFA73F317FB2A2B

http://decryptor.top/BCFA73F317FB2A2B

Targets

    • Target

      fast_gas.exe

    • Size

      164KB

    • MD5

      588efcb1febe347a30e5884ca3f57a4d

    • SHA1

      4ab8d669eff1d76e5626a26afd500dee2432b5cc

    • SHA256

      f4afe7132798deb7f231018b513af2284ed549d3e14b46e8b1190b4b9c1b5f18

    • SHA512

      7eb6535160daae7ad2ed455e1826a006efe478c968a08c09b28ff826c26bf9fb36341af8753f1fbfb8dd48201fa1b8911e7ff8e1dbbdc213d8b2c56f267090f7

MITRE ATT&CK Enterprise v6

Tasks