General

  • Target

    07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a

  • Size

    115KB

  • Sample

    200629-nyq3k7pfs2

  • MD5

    e9fc1bb19a3765d82f778e88f82593c1

  • SHA1

    792e99fd481616525c1b6f3f9835e8e24c0f4684

  • SHA256

    07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a

  • SHA512

    5730d2e249e03f415096df4d1291aae3f62320c11614d5bd9c3db28ec5291e3fc392d7cc5a2bea0f89f4af8c3922a30cb38e42cb27b8516c786276757a4046fa

Malware Config

Extracted

Family

sodinokibi

C2

kevinjodea.com

castillobalduz.es

hashkasolutindo.com

ateliergamila.com

aodaichandung.com

lapmangfpt.info.vn

nokesvilledentistry.com

quemargrasa.net

baronloan.org

girlillamarketing.com

365questions.org

pawsuppetlovers.com

antenanavi.com

mediaclan.info

courteney-cox.net

jsfg.com

pubweb.carnet.hr

urmasiimariiuniri.ro

nurturingwisdom.com

all-turtles.com

Attributes
  • net

    false

  • pid

    $2a$10$yqHeHmDbm8Qj2Loy.wjAJuPXQOvmcYBvOUOByzNUnk1j4oeHQYbZW

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3811

Extracted

Path

C:\8av98455h-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8av98455h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/47ED879AAE1C75A0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/47ED879AAE1C75A0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dqIeeB8ypEaUR0/4FlGIZ9KoTCcV4NfP+9vpnBaMvfi/tR53zG0ZygOxduhkU+hq TZO/PCan3WKAMt9tMUxk4ETql9KOj+Ey6f5u2q7oZUZDlcKOCPgZqTYF+MR/wCjj u8iBkjSOAtIgzZOiqyzhLIDucAUmh7NdCqLA4T4vxGSziTPQAIHfUx8JcwLKWz57 5ziI/wCC6aNUen33IMvxoXwkJ7Gb4YuU6ZXNV37zC0gU6p+20a5luCPjBAtoWQLK o7bCnPG+2P2EirzqtaKqRQmhkC22q5mHFdXVjSzvcAzbRInK0CC4sktAIbdid8Pz htou95PeG3Jb5G1qSauB5jrFeWHZT1wyC27/SGs/QQ8/SQ5qRS/P49Ahz3zEnUBV m9sagPAGmlUNhbEw4xrx7B08Kf6Hp13lS2z92uKYOAt0DZKXRokLJ3T6rTz9hCae iRk+TpOW+44Q2eX+XMHVpzjmdJBGEtndtAsFtqTIoh3tkAnObqvKIgdhihVGFf4x qoe26Z7kvJ2RDzzHGRy9RXjPTiOFoMSf/p5an+RUJWCVjEWbzm2wTli9apIXei5W dH5Ei6Vglw7CkQ4jR2f9Kb03TMTGBTAPwOticIxytpSgHXiZRwMd86iLiUGurcCA yT0jGtYmyd7fcTRBmpS7HffeSJyhIV6TC3lX3hq3FRh3gMIlc190928e2V1bKUzp OLCcLw5TCjlaL5MsyAHFlNEcc6qq9mEkj9ymqEgwnGomGoJQYzNJuXmUYxko3DTq VYnqgxmebw6lgfiQrsrPZWnM+hwup6E3EMeFeFzm5kIrlnDzWeUmXPs9hu0K4guB j5L69H0qu/lhoH80wpcMfH0JRmETgDYwGfKkCoDdsvPkw8djcUPzwAlNwO35ZSJ0 H6Trb866JuOOKQiG2g1o45PeFdtRgtIuALvXjuBHAMc1ZosjE9a/pVUg9arGcQdC 0ZWgJmxmcok/Kpl8FrBlX7wG123hbMc8kbT4LfzmKaNGyHcAJGAH648Glsj2ag7Z B+E37NL3GF+V8/wS2VB3EKe7yQV/p3xVNKTs1USDMs63ygeIabURPW5IP4QuVB2h fdCELKn68bys7Aj4iLQFyAVQIYsUYINXelC6BZWjwk2EUPF4dHGTDr2ZlU4Gkq4A vXCykSgG5VmNhvWQbgZRE6Au6jXtUBRZ6Artj/EaydiS0iZD4kcE1zZ0SLkO3b4K KBRiinuMfpZzHCuvs86rnz3hIb0XwBXkKYf9LwMathyAhRjqQu5TxmR2JbciYuAi mbeIiFhVlMtz8ayIsldk15UpMHG9JX6rb/qtNbzmSJEtThoJYT4= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/47ED879AAE1C75A0

http://decryptor.cc/47ED879AAE1C75A0

Extracted

Path

C:\z8ux3s0m-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension z8ux3s0m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/35DBA8A3E4EC67E6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/35DBA8A3E4EC67E6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JWrsVALVb0hWGf3P/rOE0TzvIgvB0S/5IxG5DMmd1QyZBv1206ue16MCgkWLJnx4 8Q0N3D4fpN2KyZ85Q25va1ONaZGn1VxGgI/g0UaB38LDfK9qPzOf1QQlE5EgcFrN YBHEUZD9b/HThxTB+KLXxG5yl02LghhIFww8ZoSqGIUxiVcMsjbXIrnhRcor1lTM NDjoJDv/Z5pR8vrSzU2zf5HvyeR7YVfHj/sdTyw53MrP2YADjMuv562+6tHbvtjg flr+kjOeaGvvVQpsnM8HwiULyUbCFsop5T0RMyDlh2ncfRK9tbAfrB0tsY8F3i3R 7Vs81jSZ/4FHBvnUAYmR3MiKEB+lrHEnpGikQWXtsvkk3qyhbP1XFe4jR/RpdOUe zBP/1OuNOoFlq8/IhV9r7iNCW+oHDZW46acFqqH2ukSKUwn3kZ7F61Wy+8TH34XG tqYsH8by3LR+cQ9g2rp188p/mdPLZyD6BysgPN+YpFk7FUPAkEt1EsW/oITTZgp4 hLNWDVcGHiIR0Bh9U/ejJUb1koxrRB6l/KKFPnqnCw2/gDoAolNF09K7lw+LUsRz Wn/KzuIR6zbvhnB2vq2SkmlS9VXL+9GO3zyf6MwiMfB8+nHMN9E9EdUDBjZfpXrl scvWPfTtvutsULMzLGXKtyh5cCOG+B0Rnbuv0LHwY5hLJlUCZxfAQS1ZpB8/ue0m uziolsBOQXrwTXhpwjn+UWUK1i8cdxqr2WjHHChRMGH0MA6J6b8CTTXbrCcjviUV SF/WbvQbrbp8+sC6VaWOdQv49kFgEe8loSfcKVG9ttuctj+kbVxI3SewR9FXrFUU RcRvB+ZPkKPkDPEjaGqafENFlc23ZFmWOWzShBo3LxmRTwUcXrK399h8ku5E6Ao6 AZ2tzKU+fC65aXTie2jhBjGg0nyB3gHkeQvEiFsj0DUV40hehLklFrh6gLravhho kWOeTHPQs4QLY4d94msexsdOqU0emFCE9gHOn7NoPmOGLJKTWe2/oe7iLCGvYGY+ Gpw99benLEyNI3H9JYdTcU1P42ls6hGQnM9p344QOqGjJxuqjkMNxhzKIdQgrUlp 8DhyvCaGST+7OEMFWqjmb3TrcRUGqRJQwo7RZl6Nmx7PRhSTEqFAkVeuwdee+ls3 BF2KhqD/x5NF2tf9DyuOthIhYooI1Gzjra3pqwbRz5gIT2Ey24grlkWI9ZgGR+OM ottxdChtajlv3M5l1JWNEbnVOk9dAHzEuLoblqyvIv6aELBolLZb4JrnOt2CucQt mC496S6Y5jehgalUH7wM5dGqII8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/35DBA8A3E4EC67E6

http://decryptor.cc/35DBA8A3E4EC67E6

Targets

    • Target

      07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a

    • Size

      115KB

    • MD5

      e9fc1bb19a3765d82f778e88f82593c1

    • SHA1

      792e99fd481616525c1b6f3f9835e8e24c0f4684

    • SHA256

      07346bb5f71e3c67a9ffd1b0d9602452f044b9262b468b6ed055f6548f26327a

    • SHA512

      5730d2e249e03f415096df4d1291aae3f62320c11614d5bd9c3db28ec5291e3fc392d7cc5a2bea0f89f4af8c3922a30cb38e42cb27b8516c786276757a4046fa

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run entry to start application

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks