General

  • Target

    0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

  • Size

    290KB

  • Sample

    200122-dcjzw4d3w6

  • MD5

    fb68a02333431394a9a0cdbff3717b24

  • SHA1

    1399bf98a509adb07663476dee7f9fee571e09f3

  • SHA256

    0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

  • SHA512

    e03b076d36374b263dbc63fc93e793210dc5fd809f783cda6524390590ec56b4fb5c0aa80a52650de60c31f2f6d451fee17c72256100ac7f2c15347c05ab6470

Malware Config

Extracted

Path

C:\Recovery\q5f10-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got q5f10 extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D10ECAC096968E16 Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/D10ECAC096968E16 Page will ask you for the key, here it is: Nf0eiuvX0OYlxB6+3APvS7NabvRHCjVJ+Dgku9bWeEo8rJia5JMGq9rFbJRahXuL Rf+eEDTvtPItMdtY0Zie5183mD29JQJkxYZSIhbDWb+ByfBor4f2yZqQe1xr5Ofc oQ47nmPUjiYYjHtQyRegzJd0rrder78H0jO0XW9zkbz0LQpxxl5sWuQ7+XvpHVy3 2iVKI1nLbvcb06FKYQ2ugWjd90/5nSbHuuwE8jgvEgvIyjR0CZdS96tRhqKDA/Gg 3m/QHHBOT2s03ghNMnUVVVXeVC6Srb2G6jCVQrOP9zNYEt+pI5+ipXzqz6Cdz3cm N1J1KACF/h/sRdIdZfTrxQXhyvbix9/oiyRCpC+XbWr8nak5wZEunz1QVw+SLFbn +3sGXk4oaenLDGHOHNEMvkrSWtfcpRzvEBqWZvQpekHRU1oCHP12pPzKaOhGbMeN +fAquE0YRS/GBkFpPqq0GCirLOLTtAlQs1t3Ixq7JmYTQVGQP3hhqHHMpFx8aqMh LEAH99QYsFI1xZPEBnUKZRNAGKi3nH9oXqevBCazHPLsvcHd7lR6APAsCKH3KrBf RMJTu3/QRSwlHyAvXQnibGLBjidsC/cd54q1p2QO84ZI1KpBfLbFmqsELkQhj2hS ESUZI+fFn1Zyg4z5SRDXhQ+jB+r3/3U6Ivnjd5VOxzZBqac0PAW/pH/YK13zGAIb 6kDGgnx1ih0UFEsXdA/QFiamFPGBDBIdVV5tYC90LhsRvT5J4ogMp5P1FWWEnctB f/3nZhpYRwFEkkZAWs6GNhDk3EAdTtb2fQopvqZwYPYGGEY7177x27bsjzDNkkjh VqbuHUUBGLPs+mYeSw1LM0VCA3ogjrZBGaD1PYDX7dIVBADpW2oJIDz5bwhk9+Et tCnJdnapOZBMbw1zNfD5J5nFHo1FR0Ze7gBD/LoOU7XRXI1/xB4DSjlDjJ/Thdv/ ZCkPoNALHyMzTAtH24OQbyFs1KoSH0tJsq6YL4caJFPXZKqm+hvLxsjcaAoU1Q4e dnX+l+2mQsTWolmB7CUbkzrs7P+2AHg627e0nnCaf1C5HfrMa0TLRPTh//BJ2Rq8 UgCEmA5UCyJOukbbbJWKKNdhkDup1w==
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D10ECAC096968E16

http://decryptor.top/D10ECAC096968E16

Extracted

Path

C:\odt\5c4y31391w-readme.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 5c4y31391w extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B03990EDA5488E8D Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/B03990EDA5488E8D Page will ask you for the key, here it is: KxrzNMNEpc3UFOC9RXd7HkZTpI0SlL2NhuP3/otbitxGNcpREvU7/aiVrsqMjl9G 55QSbWcH/5MIEH9eUJq/oBV06Lt2qs0aOwuKLvVp4lRGVYoNJ+hJT9BaaPyUx+/z a7HjAPo371VcNnmdfLiCtgf9O030HqZKEipJZtDFGSluvcNUZZb5qWBNwQp26/lH vkQsYYdgA7FzPd+yVdMKgfa5GICoO3rcOiY7+pCsq1VvdjlE7ruKQ3G4KUYcAyxm rM0g+fkkTYNl5gosGPy0ApA+rD9wVgOBtPT/FODfCcOCdH3iuuzbqUrd+IMPs2e6 mVaJw1iLHlHVffcs8xbwJ4Cve52Ncm11XrS9vkSTFH5Le2K6IxBu6Uq9RaYR0LRj ATuPuUHpvvKp5q30kwaqaTSwKlyll4HRT+aLjvG/pDaiom/lr9L5dsVeBQAx4MpS YkxbaFTYP+MdbvJHs/HFRQqBlAzHmXqNhMTNyJO0pAFrA+R4pWzSKiDJ7Fqj+c5W MNtVgsYM4BdfFsSL7b8WyKxdnhjqgz+mRc2mDAaQ2wLqY+9mROtHWN458RQB2nqv fWN6Ex/MhjQzvcCLoVW7j44P51t2kWiVMHDnThH+hQTz5da9JZ8b/b9gzFAAAO4Y TRL7o/FdONdJQG5+ncsVNq31klRlsEjrPIHRajRSXZ4RbAvYolJ1ms0ouQY4m520 f8x7KJoxRnjZCgBarJwQYNY2Q4v5oiE/choRZ7uIOfIhTejBXThCxqixhvj1vDsQ 1r57T9wCOqJPCo4SLU1/tLpLxqXLRDBXI4CgFbjtcDap9YCzzuZ/1CbYc1p+3PMK 2XLbFNJ2ofcZQx9hk2wOzErrkV1aUooLdFXSrdDkIZuem2kmLi+g0uq05N3bMGZp pGRK7dv3WDzI9D01waIPgbUORVtqpvyRoqrjBwuBgNs5ujCLVRKqFPXHUIfWQfWb lAxnSmpso22Lq6kyqkXdXw2dvMann8lRYqiSv31iaN+MllqEGBmSSAujT7iZLryz oa98Tw0tqezf55DF++O3KzmworLoOWCvF/jauGRmTP/TQ8CypaJZhjha6Hb86HnG kYW/zZKg
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B03990EDA5488E8D

http://decryptor.top/B03990EDA5488E8D

Targets

    • Target

      0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

    • Size

      290KB

    • MD5

      fb68a02333431394a9a0cdbff3717b24

    • SHA1

      1399bf98a509adb07663476dee7f9fee571e09f3

    • SHA256

      0fa207940ea53e2b54a2b769d8ab033a6b2c5e08c78bf4d7dade79849960b54d

    • SHA512

      e03b076d36374b263dbc63fc93e793210dc5fd809f783cda6524390590ec56b4fb5c0aa80a52650de60c31f2f6d451fee17c72256100ac7f2c15347c05ab6470

MITRE ATT&CK Enterprise v6

Tasks