General

  • Target

    svchost.exe

  • Size

    166KB

  • Sample

    200611-qkxld384hx

  • MD5

    cfd0e9822b75398979cf876a752ef248

  • SHA1

    2ed7e7697375b73dd10a62934a3d29192a993f4e

  • SHA256

    6361413fd0b01dd9bee8c2d942c78a0550eff7292c2ec5bd5bc840413fea1d7e

  • SHA512

    f0d9a9b2dcbbfb832337672769d4ee1814f3034fab9775c02ad752e949c1ca8dddb45586ef635389328d8c9597b036948ff6b6b3c8a7886b4fb7058d0546762a

Malware Config

Extracted

Family

sodinokibi

C2

yassir.pro

cuppacap.com

first-2-aid-u.com

tandartspraktijkheesch.nl

directwindowco.com

architekturbuero-wagner.net

bargningharnosand.se

ccpbroadband.com

hypozentrum.com

polymedia.dk

rerekatu.com

xn--logopdie-leverkusen-kwb.de

aminaboutique247.com

colorofhorses.com

wasmachtmeinfonds.at

jerling.de

abl1.net

thomas-hospital.de

pmcimpact.com

themadbotter.com

Attributes
  • net

    false

  • pid

    $2a$10$Cpa9oTrgTQ8KI3cqsHAVLOmOZZ9arlpbVLOpRIVOZKWP0eWFGedHG

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4185

Extracted

Path

C:\f8kp7r-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension f8kp7r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/33AF44EA8D4467E0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/33AF44EA8D4467E0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: R5uvbq6H4Xkcj22VLrEMluQBZu1rqfmTimYPczuGpMUmL6jjpTeGAV+a3kcnhcbm 7iE2YaCX+Aah+uE6vHI0PeVzyuVUqtHV5NYTCXZ3d0jQBjbwX6d4WsRjSbH6D3tJ wFEqRbHk6U2CCYUP1/+jl1Z9GdYAi2N4rC1S3lhq/S9MLmPiuoLlQOxd2fOAEzsV TSBgGuatYdVExkm1Ro0NTxDjg8n259E2Dmaawpc62AI0XENXFIgWoTL42VDDtdC1 4t2q7Qd6y+VoIA/qWf2Wp76wkYnhINe+wdqCHDmK554P5QdSknnMwYM43XEPku+a frZhbz+byRZS0NYmMT/15Pa5MI5BVDIMt+xHOeUxBeCmHtW58v3mKKiE0NjTSYfI Tg9z5uPdLTe3jGkH6eqO1OHFwTXzhBhLwXDkr/+m4t8UTzb5B6kdBWGQm9Q0cmjH nGhz6dPzaG/a3Hgjjg/I+XGPjJy7jq3CYcXFnJP49fqx6SUDhdoJNsijMji9ZqXx RH4KQyiITJhfS6eW//iS5xeaN+ecnjQkGQ/CW2nhekB6ljeawxZm2t04Vq7pIuLX t3x9YrgLQcHU5awkwu4cWY1gRrWaHYTxKLKS6/qfgzYviqBD4W8iEEMkv0Ai6cv7 ebDtvlZ99NweJtmLu4bVLh0vEAvrr65jyj0ABK3PQauEM+PaApj4unu1gmYX4g68 pbBTzNHIHt9jAFi+MIvFT866u2xyU47yUNViy253/hYfwEagOBZz/U3WfoSH8bqW 8m4w8GH0pW55lOiAeJtV4INDuBvzckdslgLg6xy2AsMEQLmsxwe/vKoJWHfPNAX4 5e2Xe9kHnvFT8GUFXq6bJd0ct/cC76xnP4W4vfjK9OvGzeu8B6+OYVIhCKiljk4v D7K67sU4hBCr7VkF1ynEAxLrYZYuAvoKOh3N1np+UctMMWfbawlY672kaUg8z19x vry25tg45nDsm+gDpV+iX6e/vvFdK/5yx2iTr2zV7FGIxZXmkJe4ukvTAYz4EAj5 EVu4TDMuJXtvuveUNfLlky4gC4lC4tnyDoovL8be/nWBRHRQQSWA5BcGELxSAkXl cMSnv+T1fc6R0vv3Vmx1YD3RRDF9QtW0eAW91IHaBYHc4u3mJOu7faJYD5osA6yJ 34A4B1AMINQHMxRmRaXhMlNudypASySJRbD+8+SLmUlDgefGhhPSbvKnq/umBFyO OP2Qf9xd7c2jTgEtQrD5rK0te5vsTCGsWGqMaeMxdt70D5xvTQOq6fGBZstKT/J/ hs9CUTvDzXtIW4ci56o3ZhgZdmOydGOjj4xAgk5sr7k= Extension name: f8kp7r ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/33AF44EA8D4467E0

http://decryptor.cc/33AF44EA8D4467E0

Extracted

Path

C:\ynzi30-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ynzi30. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A53D520FEDDA4258 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A53D520FEDDA4258 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MGgxaBM5yzvDRwmigesw5md7/i3AjPOEwkU7VJCGnbq3B/iiy9qAy7fINOgCitUh RRrtObY8d4ZM4M0NSvx1dNrACzLRL6jNpUDjPgUaztiF7GHecqLWlSNKl1RAAdDK uYscbKWYbQqM1p833+GAhOX2qGF5elimV72fCfEngp8vontA/jIJgINXrtrnjcDe 0G4wpgMa55E/s9/74uaNgcNROCEHEHRwBUAq+AuTVzNQ5HaRlbO20O+dcxA/omK1 hazaix2WZpvHlW3S0pVCy+7ZDQma2Vo/cE7EP0RH/L9vRZ8eFbzD/+1wuLpv79Lx j0gaykCNxCUp33a0B6BWdS6i3kVgKbDruvo/rWOqnpZ2P8LIiHjfOQ/I2BngETsX D9bnbbz+voJqSiHrg0JGg1acV5EMuNKUrMzt+SIem2yjSUmBaMYh6WhmgZGEKHKS QrFdjhNmQPgf1/FdndPJK8S5CCr5vKmpZ9IzcNzzXUfDpydmGWOMBjjLzlTjYGrt vNlP4D51C7s6K2m7kA9gURcRtD+dT4AH7Zi8KOfH7Fv1J/Px5LVGgkDrJgn1I76y +nLFu9fVPINQc9Op0TB1P+aewYLIP/03p3KyaOlqBI7ETJdz9YbTwyg/I6gtkCr0 lBDl/uA6hRtkL/VCsBEa0pRA7wopY7m3S9bp5jXx0jcxqGTXoZsfD9DeiZoflHjr 3P4po9oYthigt2VoVTLFRJaUpu/SB6Yc9E9J/XnZiK1yiMHi+1pEPnaDrVTNgMUn CPDi34+qQbQGuKdM8AwCeoBTeXQcEpj+8wMpgIZ7NqM5X4/YpctApRGggvuHiQrt Lue5IaVxNJBpjVTPp7mxRw+ae2UbRB8/Bf4KEt0fvTTiR34UZdxd2Ts/oVFaKHzN nkpp1BUd1gmKunxIIh/t9YTG+hR42vVTlWobtYkIlwmyisevS/FION20v/VhK2Vf KEm4yixpA3wVNiZDq15UFKSIwAUMqeiyIUAS/+9R5PhHZjv9zvtj793jxybWG5Ue X/y2iDE3dNgLN03B217sOZCSIkkmp8NW/+CiKutxkjzEJUSns111HJPoNSjVU+B6 C5WSQnLmNqje4Qeae1ORK6SrXyVJXov33Wv2PxjZnxCqCHz1Fim/z7eTdhK7DenH 1E4Gq4Sy0LTs82okhWtAkR9bRUHbRas2C9BIO8+tdPbCT+hFby3DzonJv3oCS4wq Aa2/xw2JXOwYPVPc+Vi8QRSt1PTPRSjkDNo5aVZFpI8EwSz0C2yt+vIwjw/qg0QO mVkL30dMJYHoRUnvinqIxA== Extension name: ynzi30 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A53D520FEDDA4258

http://decryptor.cc/A53D520FEDDA4258

Targets

    • Target

      svchost.exe

    • Size

      166KB

    • MD5

      cfd0e9822b75398979cf876a752ef248

    • SHA1

      2ed7e7697375b73dd10a62934a3d29192a993f4e

    • SHA256

      6361413fd0b01dd9bee8c2d942c78a0550eff7292c2ec5bd5bc840413fea1d7e

    • SHA512

      f0d9a9b2dcbbfb832337672769d4ee1814f3034fab9775c02ad752e949c1ca8dddb45586ef635389328d8c9597b036948ff6b6b3c8a7886b4fb7058d0546762a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run entry to start application

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks