General

  • Target

    1.exe

  • Size

    234KB

  • Sample

    200509-m7as93n5rs

  • MD5

    f084eae234967eded358d98d11aed693

  • SHA1

    e841d89f5605108f6304d50ebb384aa62ec3ecaa

  • SHA256

    adef0855d17dd8dddcb6c4446e58aa9f5508a0453f53dd3feff8d034d692616f

  • SHA512

    8d66f0319741f4daad87919a3f48605e7f81a5556009c8575ae0aff95c2ddd78116bdaf74e10509a6f908f45e0155c71eb320274154c7016cbb72a09d5618d59

Malware Config

Extracted

Path

C:\t7724q5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion t7724q5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9A926EB94FA105AA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9A926EB94FA105AA c) If you are having difficulty purchase bitcoins, or you doubt in buying decryptor, contact to any data recovery company in your country, they will give you more guarantees and take purchase and decryption procedure on themselves. Almost all such companies heared about us and know that our decryption program work, so they can help you. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LdbvHplrksXGQgGBsw4J/d5wKvUD3+QslDBuP703X/imiQmV7m9NmJFk9NfgHCAX PJWWaMk1RZWpYlcipITKEmG2Hdg0wqzka2HCSQK67qKNy57iNWnSeAwNzfQMqYw0 a8t/TmM6Q83mK8EJyqY1tlIVMNr5uYYaWNjqH9fs42v8TBnVDHvklQ15qqZtdWg4 X2k9MXmDaasQ2Gmse03NuQtcYYuFKYK3lSK41PbT34RgIU6yS/OS/wFKhj+E216/ SGdCWWqIHmk5dQyE/2QQuGLVWFY9WjpxFVuwDakYoFJKtqDdq/GffXlzYHuiaJAE ssTDkL6hnprkzWxsnsOBEf/FzXHA/yUhQ4uuYKqf9N5s6LWP+XM8LhH52b0/5Z/G s7y20VJwfwx/Pkj0wVs2Dd0t554A23pvj7DUHEvo3rMhZXqKaNxHfyWZHnuwZfVa tvzuvbmBYuzGwbN/s9Jk97LOTHILum6TUch28L9UhsBeuNnzN0cMnoIT/hQ4oDrl JckdZRzuDjQvinFlkbuppGgMKtJXe/TfEXIJn2bKfBBE0pBSTTUQOp1kI+JdWCMF ++Tyb1uGGKC+JoN06wkRa92aeKsUN0WZOzTChTNly06/7Ha2/PP2IpJKRKo9MoUj jgCEbnVEQhUDKcm6BRX2i+d+ZN+m+C+AR70/KAAVFqfJcP3u+jZx8muBaOfIuL5z 3YE1Y2kiKOsfY6Or5Gh9SMQaslpORqTNQQApp91Pz5eed2RNK9xa+VBof6h+LQU9 Gnw3mLKQ60ZuZmfma9oUR0AuKVkA3SPtEjkidt/C89eycnQVladW9BCbaFE2JGQr g2+nseCqXDOWV1VsYqwGvKzvIiW0VMxQ0VPfVKPKiHJIH5CDKBTAyppdEhvu0iVT lHjOuWeGLkhP5LMdYz8wzlsqgUk44q0uRgbD6gaN//IoqnFzs+TitlMf2TDZcieC iuzzucgfb10/P8w0IKIUNAUm8fVllwG3FsgGNf8NzD4TfYP/Rksl36Mu4njdy89n L8r5YfCRtC9tnSex+xvFrhIfFgZLeHK3hl0F0z9tzMJBe/vv+GrJoKoAALHI+B3X xqW0np8D7zRDBAYTXEIxqnlrrB+w9hmvKWeVjGhNgEHZEi/3kdQgZd8Mr4+KH0JQ w5Jhp6wz4FdWqPjO Extension name: t7724q5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9A926EB94FA105AA

http://decryptor.top/9A926EB94FA105AA

Extracted

Path

C:\1zac11n-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 1zac11n. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73F0511197A918F7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/73F0511197A918F7 c) If you are having difficulty purchase bitcoins, or you doubt in buying decryptor, contact to any data recovery company in your country, they will give you more guarantees and take purchase and decryption procedure on themselves. Almost all such companies heared about us and know that our decryption program work, so they can help you. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cxs2Oz2rNbS/g6LAuomfOGLEj8q9EV5/osKKkjH8jzjS5icMdu4F7znMKSNKzGRY aDQYpoqcBjSNU0Ogtgj/qJubg0RiaNaAzA135rV++mNgWIZ8v9qXChV8331IRA9P xhxSuE+kbjs4OnSSv607boag7fZA03rawMnC31RUognEJp971/ycolJ+4qXPlrVn kyxhLZ6giPZgIjwwARPvXr6RphXWHxGa6yeGY2IByczcdAdzSp+hth45Vwdku7aP rokkmAOwhSK7hnIidqInWi8YJvEcOQw+0Y2B8xgupPACrVgs4IIgeLkXzoiw/eYq sy3+MCudAlEy9CcHRbxH4RkGq8w3OP3PImyuNd/6/2nt2cwLfUQ+l8IrABBymEIB yerSFSOh2YDGhJTHGgjn+HMswacB2A3aA62RtuIFl2d4wabEoYPyzVOiVOmGpumB 3fQssxhSGVNeDJHbHS+R/Ct4FpQ7F8j8DsHQDRmJUVC/Ldi+WkIMxJllm5oMNUAI Jol6oYz2ZZDj8R7hNlklxLXJPfcDMWvscSZ1ahGrfZcRJBW+GcNKy2suFEPq2XlQ 4qnRn3O3UmRp8o+6hR8Q5W20luMaJjTh0J6Pn1x/FtU3VsBx9OwU2ixOi8w/dkMn Z7JVqlTICLq2CZUCf89Cfp7eE521MzAQrekecGjw0R6FRsajij1Q3pZhwV+9iuZC 8x7Zr6FFqOa4k/zhPnkyHxQysniuetloMrUFbmgNrBJoE9VH2y+LAU6JIuvHm8tJ vO054PatY5mPeF/O7BMLLj77pvRNwP/QUZy4eh3V8kW5lt6m6x5RRlgZyf4fDaTn FWSBVKrzLc75Gm0GjupeJzZYzhJdv+CXkiMLu0QxxhCMpQTTspz5vI3A1MtGRBYm Tmj+zcksvDq6cGFoMEiqoRhyWNOUGp+Sf8cH8/UTFlCwzGM3wSzkZaZJWi8Fxmsx sv+DTohW5eNj0DxJJfwaivv1MbqvSeYoI/ZJX7ZOjyS0pMxtK1+Y55n0pom9AYSr Gs9ZAcAXN/vMNduw6hDXka4XqMp4s0Ar1Jf3WLmB2WMoD+q+dr7WXMne754uCHAD 0nAl4hor+gx7DBZ0lZEdYVd8ImLAvhpk5rz2HW/5TcGeV5dWjkvC8xHx8xU= Extension name: 1zac11n ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73F0511197A918F7

http://decryptor.top/73F0511197A918F7

Targets

    • Target

      1.exe

    • Size

      234KB

    • MD5

      f084eae234967eded358d98d11aed693

    • SHA1

      e841d89f5605108f6304d50ebb384aa62ec3ecaa

    • SHA256

      adef0855d17dd8dddcb6c4446e58aa9f5508a0453f53dd3feff8d034d692616f

    • SHA512

      8d66f0319741f4daad87919a3f48605e7f81a5556009c8575ae0aff95c2ddd78116bdaf74e10509a6f908f45e0155c71eb320274154c7016cbb72a09d5618d59

MITRE ATT&CK Enterprise v6

Tasks