General

  • Target

    4D84641B65D8BB6C3EF03BF59434242D.bin

  • Size

    115KB

  • Sample

    200624-pdt44nqn6x

  • MD5

    4d84641b65d8bb6c3ef03bf59434242d

  • SHA1

    e5d8d5eecf7957996485cbc1cdbead9221672a1a

  • SHA256

    b8d7fb4488c0556385498271ab9fffdf0eb38bb2a330265d9852e3a6288092aa

  • SHA512

    4ed5bbadaed139a48b9cc7021f9b3f8cf1cdfad27911469f06a512a30fc3e8bde48a1844942adff50a931108b57f91ba2222a89363c038b51120da6b535d1b84

Malware Config

Extracted

Path

C:\0wf8w8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 0wf8w8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C08285A007995BAB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C08285A007995BAB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: coHFW9ckWoJwLBVE2qpy07U76Dj66ePgzo5t7yrSOE79lf3QC2+l96cDsnW6LQ8S fGecBUFGTPAu7j4xKUaL/cmcXgSMXG2/x+u62N+EvjnjcY4ptZ0nVAqd9uKr6QbR o9CG6Qy3xEgXASDt9+1Prlv/Djb/UxwQOiiGsfg4B0qAokMGHMu2OVixldi5HmmH c9GnKvUHN3mUEGfRwlt5DpZPrLO3hO1NqEaFKYqsbK8c/KZjF/vO7cC/wTMV228y b69fpha86p/hIZ327WwOxIX3TBXASEBRcFdVUoqNkL/SpXrm3pGdN+9CEeDP1rtO m5JluPrxAsPULsBvL1bEVDPR0rA7ZdE4tFnOi8/fAE7/9QxqHSMZ3FqqBWqdkKlz VUOagsF9mF7cLVJd0miNwE1+a+xZeycYGcowRNc09Hf1e2bRB/Lxa/uvzli424nF sn837aqcGWemwWSiCBYZ32xl46Ni2JqZ792dpt+e+gnkU0HTb5vf73sh3hYjGxtM f2OmVR0zzj6YZQu1zWzi6u5ji0g3wFBGUNwhSwJvN/kADcgBqfe52Fysb/7cQEfQ hFEKIbjy3VNcfP/bDPe8mTN6DufO7d3w7CHAbM+iCv12YkIbBbaYxli/vyLfTwcq hR4T0fTAx69cSk4vzcISMGcYB3EQCBoR8DnfpMjFtdVewGqxvg4Z5P0jO3+8m3O1 e/NQT631Sv71nbrSei0FXaPD0Fz8wcfIJleEXW0NgB9skAK9y8xSciDV2hZQY2Gy fPnz86THh38sEAfehH6C6KwMeUzOfHVdDTzXSrKUd5jtvRoPN2570wEApY4hw+Yk R5S0FnQhjsJpdiO7aNemJtkKXXz4+HOd3HJXejW5nY7WTMK9emBVX6GipthIeFrS CT6LmreZdXRNK64M0yEhASAO7n0RKKGLvcbw3xfDR/kZA57N2KbxJi7i2LiYqrML 5aN6q0AFuM+3nH0OcRMfwSVOqSL1VKnsOVPVsFaohtOLdsj4KMjyEgtcq9oOGGgI cCDA4Sd3s8upiA/qZp+P6w+Q3/hH5yrn+gyb5fwVgOhdIaepv4HXronFw3l0/oga QvJyKAuxBVTqxdIcoKVXyii1WOiJlLDpdSELr3AQMBltUEx+z+U0Ld/oap4MiY5x 2ormmOk4chB2WeSctE/iMVQyn9U8Eyac8Oe5IKuoa2QgZbi1isqj/hlZYVAPp9BY 5uST5F+4/VdG8vfMNmHZdrO0Gqvzisy7BuEm5cnXIUnFsIc+avmcgiChKvJyKMJX 8NKFY8lvEEiesPF55mQelBLFpugGmIylNJG541PxeTw= Extension name: 0wf8w8 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C08285A007995BAB

http://decryptor.cc/C08285A007995BAB

Extracted

Path

C:\7n4cj-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7n4cj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A624311CA42C91FD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A624311CA42C91FD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: oznBQFyreImuCnI1Wsh/dleUrqNzDmR8oJsWuOpAq4l3x4icCYWDfEZQYOLlI3ax K807N8LBGkDafUNRPQ3q5B4ULZhRY9gCU4N3cRSV3CZSt8S8Zs9ZGpWXAquvJxXW XKXrsy1F704qbUCCglNLQ/gamPgqFLOCRn9QITj2ZjxWDdAB6JGPc94Hr57WN6WT d5c2LS9rGxnAXNDcN3ws1aLHQvbXFc+YR1eLOYi70Q3imWZcCy3wh/LhvvLy7pui flR6K7gy3WPqyX1swB4LbHLTfXOodE1DnsJJRdwxHnrJly4kOZaIpFHD3E/Cvtiw 4eei97PtorJ+HI8B5L8hjIRL1TljcQuDFud00hsPKFjDS5+nUOXbRLD6R/dS+MP8 OPkibFmuDxuvDNn2v/yWfBsSFkrNL0yrwBT9GwINT1t1IDQoXVurHGEXE9zA+U8t 1tmJm+h/ozMqTr6ovGfdSOA+X7L7HQtaKXc+Wx3O7UnVGHeRnQN1YqS0fzu0k7g3 6jRks+7gHFiG9KOCtLOgIp/oBhd8c0LvBgcuFVVhXzHd0LtCGB5K9PPLuZMj1izW DfR6TtnzEeHmkehc6uNg5S53S3/GUCmklAp7QpLYr+HB12m2Fdzfw4yEl3xT3BTm Fw6oRQH64BaJ29oOyCUQ5ZeUkkf+3W7slc/8g4LsQEJj5bt3cRGQAHYA7pp9Pz0i 9E6IFWBO28JKSigxLybaQzf3S7Kwr2hNO/80Um3e4wT+Wn452ZEqTk65elEW8N0N stSMe3xvhaC9GZXpRcUlVX54BKKiSP+Oy4THDSRJlY/zC/ZplfiIJVpjSg/cBJK4 KlJQkb9d0QhDFGtXO3pN1f3UvHg0u5u2s9cRRBl+Y0DJkcYJXJgLMme3alisiAgK S/oJ1by++9w5t5qehzXQoELZOtKDrJUAdHxCoI88hR2JHblGndiUezNMmU87rWsJ FDSHqiB8op/Mr6N/AD+PWV1Sb/93gNfKq/F5GKaLj7/EOQFbVsPh6VPhsp1E9KUB //bm1mvMeQcPGhtidxwKAYhqHL9qhgDpY5V0RLdtAjPvalM8zsZIalTmSAIehPt3 HHhDTA9DoulGzoQjl7nNQI2YDgd1lsU+KokPMy3YSihVd9D7528zPIrizCXjinD7 iqn6zIm3EZFg4PZqz7mj33hyFTkn/j4zkUDMoKqsOxaa2E7e25+cFiX0qo7YHlz2 Dt3cwkD/tty5odActPRNSzjJY5xvkXoxcPnDGaxjD4nbZ6O3pDeqpaoag7SM9uSo n5ZRW7iFt2fow6nkvIo= Extension name: 7n4cj ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A624311CA42C91FD

http://decryptor.cc/A624311CA42C91FD

Targets

    • Target

      4D84641B65D8BB6C3EF03BF59434242D.bin

    • Size

      115KB

    • MD5

      4d84641b65d8bb6c3ef03bf59434242d

    • SHA1

      e5d8d5eecf7957996485cbc1cdbead9221672a1a

    • SHA256

      b8d7fb4488c0556385498271ab9fffdf0eb38bb2a330265d9852e3a6288092aa

    • SHA512

      4ed5bbadaed139a48b9cc7021f9b3f8cf1cdfad27911469f06a512a30fc3e8bde48a1844942adff50a931108b57f91ba2222a89363c038b51120da6b535d1b84

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks