General

  • Target

    ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

  • Size

    115KB

  • Sample

    200506-xxntd3rn7x

  • MD5

    63a945da1a63a8e56e8220c4ccf7fd0c

  • SHA1

    a99cf1a2426edeac97c789d0a4b7d38606d7aa45

  • SHA256

    ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

  • SHA512

    34006d84587ea90e243ebe0dd6bde8bd502ed688001a412898cd4e4c16a5de5788a9fa4c53d3ea79e4307adaa74496e05b205bf9717ac833db976551b1a7c89c

Malware Config

Extracted

Family

sodinokibi

C2

creative-waves.co.uk

apolomarcas.com

dezatec.es

jorgobe.at

consultaractadenacimiento.com

houseofplus.com

goodgirlrecovery.com

slimidealherbal.com

allamatberedare.se

radaradvies.nl

smithmediastrategies.com

ahouseforlease.com

plastidip.com.ar

sloverse.com

simplyblessedbykeepingitreal.com

mastertechengineering.com

planchaavapor.net

danielblum.info

4youbeautysalon.com

marchand-sloboda.com

Attributes
  • net

    false

  • pid

    $2a$10$BllCF1wpSZtPkRTz1ibVTuYtOj1obpokRVBBYVM/plW9vdYxxgpqi

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions The final price depends on how fast you write to us. We also have gathered your sensitive data. We would share it in case you refuse to pay.

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4166

Extracted

Path

C:\of6bj8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension of6bj8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A49B8DA88B517922 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A49B8DA88B517922 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: qmPs+7DXVcQ6f5yWJ0+blMu0rSfxjTQc3pvMnSDSrJ0v2Njbvy58FKHihSObz7NO X5EZSB1E6IzWA/BlqtmrrwF22+e10MmGGP8lOVYtkoy9L8j5TeXTogdMXetI2XTf b28LBdPILroZm/PWB/J9BphEpT0/FL3GiAFLH718gaWA2nx1jzT6QbNq9rkwzWdV MDNgsR2ArRx3O01API7T5XlLLPJKM1o0K8bOcy11mgJ7s8Xe/goMeqhqa7HHzUg2 OLrV7P3r7B92aX1NQo9OqTEWG0fiQWhiPATujYCojBq/AxN/OTmnUWFavfn3rgYz /+Qnc5X5k7BtmTtk3aFmpMN4mJn0L8cEbiO00uqhy3RBrUX2DYaa895ZYqD1TU6J lzvLWIdPYh0MPdfR0n5nsNotMUwArl9jKCvRqPFYkQINVLEH/9FzYhElS1HKOaNF hLXY7SDRVUPhH2EaMy/2FuHprvNPfka7KrfQ8VDGEg3w2T0qWtMrhzLCP5oprZQi R5MR2lEdtT39xn4MXHkY7OpNoWSz/76J1Lh12uy8XPglKcj7UOJZ6q3LrJYviVWT vqIjDMgrfWAi7hPtjdp0d5XaQjl5aAAmppZNazTJJiU/9VauLkKt2CKkOtGN3VRR btsdZDGZvncpDdVZiWBsn5BD8eEBO7I/65TZmQiEZcPNoSqNew46zWIy4MIo1KTy QduvoAhsV44WR5Y90MMxL7sr74Qmdq0YaIgrFJkAoHqOx7cztJ25MiDI6RT19ZWc goau4nzVkm5FYPvLjosRFoujdRmZDnM+OstbcKW/hZx04HCtd6YvQ0cn9drD+ZuJ hrdUXIgNjYtX85NRSiuh5IqcFd6klvPVcSbcVdAHUZUqbostQSOHxEJypK2DEaEE 1xJihfrslzBltJRCvttJ/8MeLcwH9NQd7KBjoZgfzm/KJvcqX7pR4b2J3kiv4NL2 /bwUW7A3dvM9keHeRMBpLPs16AaCi99qUQNh9JJXa8MqzRl3Z3PrnW+0JNc97kvd OyJrw+34EiD7hVNsCwqss8z9BRmTak2Coy9h5TFC6qn8WowB1DnbTxbr1StyZkIK EXWsRtyg+kOZbo1tt5HToONy0zPsvdDB/HHm2h+fmjiAnbGNhymDVtn3lFFovWDg 6MhkFFKD2SeVq8uvPnl7jlr2gg660Vf72ob3CfUKr9KidWEGkDSiIOBBgzfg4Tqt qgLahj3P4aBDPXnsLymtRy3i1exJg/oH/gCUqCqn6en7x4wtGzm3Ou5WPxd6wlBg QpP1MwsC3uy3LdYKNbLuxQ79FgR5ELYUbmNTExGnnsQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A49B8DA88B517922

http://decryptor.cc/A49B8DA88B517922

Extracted

Path

C:\5h048-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5h048. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We have copied financial files and other important information about personal data, it will be published on the Internet or will be used against you if you do not pay us, so if you do not want such consequences as customer churn, media coverage, fines like GDRP and other damages, we recommend you to contact us and pay the ransom. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BC069A7E158C2157 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BC069A7E158C2157 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JTHI8Qzg728y6dyTwFzFLGQ0xqoOex1x9FRmMn7ZLgjeVORd23hkMcQdsR9rwd9+ GyfsLYqpp6RExyXKatkEmvv3rD/hTkZAIgCf5ZhlQdWpn2AxpRhT4PbNyCkjhKqo GhBWeAc2vOUDhCzrzkxv12xH/99y4sc+MYs+9COzAqNoLbJg+L1BhbAYkgq4lz5G cpjRoG3T74kpO8sp2ek34u/VNPYTv1lmk/XFHSgYeXtEVcBS4trWOdalWh2IbJ09 RFvwndqPTqHci74/BC6mzQMt9MohhpxxCYbJQV3Iljflxz8SOmHNddoTyYI/XCx6 UgzhQJQPb3lkMjF4dexVxWUKJaNQxQGvgRTPZ73n6punIfmGgRs9EfqMRb+pD5D1 f+M+4j8qGPBXfoEfCa8yatuLvNHJzl6EJXxFNVwMTUP2Te8aXFShBOAei9AnP/6A ZxBR95hzjxakCP5/oTlFZ+8k2R3wRxJWzCcHw0rKDtjqBewcH1TVNisL24VvsXop 9201B8OxS0EkjhXKL/i8HDYYtyjODLGJ+4C2u5jCRR2rIsr166reIF3fo6twbCpK z+7T28wUjjrdaaBQaOnrP0Rn5nQw+0t6bw4AJViOrzFjX+pl2FunwXMyNecipM0U 4/3rTwqj+uqOYv7MFTy4AmG10E9vihrBu8Oj5sQkSJcJ1CFuXzhFgUzu1w/1Fn2K dj7Zy01BQoB1A8/9J37qTB2k/vsCaiyoausqPpua7ed64ARh5lKpqSZOmsrB5bq4 5lGTFWifQ8STDGzBqP3/6otYgRdvBIxmR/lCUnzercyyaPiUiCHkg1gcCD3cUcjy LnwszsITJunnM0FgdgxreGa7t32JcOE2DmPzuSV6lCb3AMjAeW9ZYUx9fE4+Ti8y 28E51HenLDkgBry81WcRDSIMsQQ9LrJnS4kcPtWPMQEujtD0/vKqZtFVpYjARSCD e9s29Hm1B67h32sEqxs28XaiRm9NYX1d1JNwnG+yOWfnBa3/Tt4ZKRULmMOIVZhx Z79C4UetaJAc6HEu+VioYj9PKU3Xgf38X28qpcfM77Gx4TX4RjJrADilbbFKUBzM 6l0aVrcej0/M2mSnywUBth+pOdLRGebVbPqhtZimkpbDu705ouRS3L5zoNmAWlob 7mgw0u77H1GyXIPzmxVSj1SMUtcY2sf4vqEa3e0JcmMs2zLXERpcJyLkxQh7j+x0 ud5/UyJVP4CQK2vaAbZO4i+IEs253VrX8V0iRwEB1qmDO94tiZFyEYl+3ijciSDg BIzJ1f5KRQXhUZHbzFU= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BC069A7E158C2157

http://decryptor.cc/BC069A7E158C2157

Targets

    • Target

      ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

    • Size

      115KB

    • MD5

      63a945da1a63a8e56e8220c4ccf7fd0c

    • SHA1

      a99cf1a2426edeac97c789d0a4b7d38606d7aa45

    • SHA256

      ffe7fe45327645a48ca83b7dd4586de22618206001b7a7354d9d285e0308f195

    • SHA512

      34006d84587ea90e243ebe0dd6bde8bd502ed688001a412898cd4e4c16a5de5788a9fa4c53d3ea79e4307adaa74496e05b205bf9717ac833db976551b1a7c89c

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks