General

  • Target

    7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464

  • Size

    175KB

  • Sample

    200706-nc5ayyph22

  • MD5

    5a9e750f4d1d2514c496f43b1e20a94f

  • SHA1

    c02a6413d43da9e8299c0eaab2252a20792da5c4

  • SHA256

    7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464

  • SHA512

    8159e927281c9320422132030847fcbd94c2e322bd6cfac2d0c222e27fb11e7eea956df22785a2b19b43dac5e2474ca06c98e0e416162b75d82392cb730fab23

Malware Config

Extracted

Path

C:\52hi0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 52hi0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AC61F4D50BC89641 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/AC61F4D50BC89641 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NzK+5q4zylglGagsfoebadpqTdW3omOTylDzcsfuT6Lot81uaQBuP++XVxnMnMW+ eqDh750fCUXprCdBwC+QOKuAbAhaxvIEl8uM00CDuOAsnjkia79TiSTJSDgNry8k Nw1x9DlhFLsbmhDvLVBADmvPJPL4RrL+XH9tCvGzdveIyHddF2U5VFP3jfemJeF2 BUm1fUtSr5mg/VdtAgWBvnnxXD2P/CJZPuuZOUsSTS1tHdS6vyvZe4C2j5vqWG+d 5ghPy0PIDyUZY1NTCMMFen46yjRg5QguEwOdHHPvJ3NTQQormDCb+YKftXRaJcLS YqHdgcsbcNyw+KBi0HyGyCCTXxwRoEUnoutq/rEtrt+cX0c5m0tIQr4E39gZWQIo rY+JF70UDhL/CfNF11NGL39s732ixRv1y6qgxjwYvbGBgvuKqtc07pPDxd+SeMtk 34f4pGopf+TvjnpqNFNaKXBUHkr/nviGqqH2mcMRDZp8uxV0LzfQ1fsrKeGwrw5y VdNoIYpeNPOFemQX0x2wDA4GUtLG88Vo7JLGrrt9mztfJ3w7jPqkgf71APa6QpjB As8H4qK0r+qZmny+MFEqg2KFN1p84Hh74h5IWNhbJqRihR1WAM+3yW+cKBzZTsXd Ez9lmomssKckV1TGEX/1eNN5iCgOEgC6RvOJ0WQ2aY/Vn3xYnwW/apjNjU4A0kYn aYH8Ykbca+8neOLcSy2IHsTkmozpyIwGEdECrJvJoPMSnV43a5JTG7bdYeJBepm8 dIUEm/i2o6GRBN9ucgZ/9RbNh/yrZWlfuWaR6xR9/CsWZASCOdZzUjwbWL/Sv91H AKbO4Ju/8z5RGMHYl8Q5XoYJWh8ho1k96Ora4Wo77bxKVVEnT5DjM1YDgGoxR9qt Xc6IzSkLgOMfMEj+vUe5k6SvEV0WxE2QbFYoraIwZPeiFsaHft3a/56oK/ZDrRjY cnU6HrR2mb0lzLjKjg0zAfVXhAyHIbpJbNpvPfRp58Ok4Zq6nZSnRdKRD8CWjzKM +d72Vfh7cgVqQDO2GVhAxhfAAMaX2HZMcbkFc8CXz72jzZ04+7czYD3VjqbDOFdV waJMdzBcYp6jImy+ZQoqU3qtb2ZM6bdHe0gdXmrxJGfWOfCxtjfXJdAN01QdYOJp Z64Iplz0wpd7J4tjBphQKnujK7KAGWLnGhZXj6nVJMnbx8RdsstA/WrIjyFZU36y CJFz2a+qztxUaODanT+S9JZ1eZtfj9Zlg6lbcqLJoEysrJ6wNvqGM8xs+QNAcm8q RnZ03RXC9CQzB7kedAOI3YTog0dDxd2jGuKvy6yf ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AC61F4D50BC89641

http://decryptor.cc/AC61F4D50BC89641

Extracted

Family

sodinokibi

C2

patrickfoundation.net

stopilhan.com

johnsonfamilyfarmblog.wordpress.com

bafuncs.org

forskolorna.org

wraithco.com

bodyfulls.com

epwritescom.wordpress.com

gadgetedges.com

commonground-stories.com

brawnmediany.com

webmaster-peloton.com

blogdecachorros.com

zieglerbrothers.de

erstatningsadvokaterne.dk

winrace.no

lubetkinmediacompanies.com

berlin-bamboo-bikes.org

delchacay.com.ar

cimanchesterescorts.co.uk

Attributes
  • net

    false

  • pid

    $2a$10$.f7IpgYtYZGmT5sKVxP4DeexwfYEU6ILqgG3IL3orW0F9eevOA7L6

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4769

Extracted

Path

C:\e851243h-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome Riedel Company ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension e851243h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/07E59509D684597E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/07E59509D684597E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +OR5sxhqvtlbCQOMAF4dqX3p3L5ulyX17P/W2Tc4izUiOF9k+eoDxTHtoGWvw47r crIaFigN74cui4/xaaqHxeAQDANZ30+Cwi4fCl7D/uwRXMuyGF1msS+KtmxEX9l3 mvmn1Ydmyh7GiQue+kbqCu1OLnIKYzrA/aQPYlGzQjos/E21DFm2l7ci2AGuqhbx gYULQZRFIkSML+B0rEqCovL1VccWAXknnzi2PnuWTW2eMOtWhARuUIwE3RYX2GKx vwSXJ47ymnQNJJljgOvp8YdwQTMx06A8G15q7SkdA6duOAsXPLBa3BYp0wfgqVn0 JiJd1HyZ5awKWUnkgI9eY22OUJS8jL8q0vy3NKg9x+rM+F9HMI5rGR8Vx2LDflm0 dmXHxDHRGDR+Kksx69BcF1kccqDDtdcmpW/+nlkjyjDQtKRPu81pc0nbnZEJMLcp RcJ8m3hn698dmzpBbaOP7o9xW2oelf7vdLDnBB/JsdDSoGkz92D/RcN5CfRFXxdw otvUol7+dpfe19LqTytc8sNffWGXi+FIJmPjXyjVYH4okrYx3SS1NsndFOLaj443 erePtpVsSlDdjnriRUS5bfG4E3TQgvEx57ln7OOGqxEavpzh1aC5cTKWXr+PfuB8 pUbyUSBrCY8d4A68rYFvgBmi0leQkDdgu+waKSv97xsBxRuMTMQyEkfHMMDGHP1S VlU1e8/TkK76ZOxmguWPVDrRIUsjMJJMahBFEw8+suIwpC07m4Qt4eLP27JbsEHw aTZGaXvAYKWsfRt5x4Bowbtq7i/qRlF+g9AsTlNQulzMHyQgbRMQV4Nj7GUjMujs JWJOOBTY28XISxEuqwqFjvVrY9nndoLJftW3lXauO1oBa3Kiu+5RsbtFz4xtQF8u IbkEDkT7gef6pr12WXSPTtMzyoJJGjkrXNUAop4gGnd88OudXyh5sxYKet8W81vn Bh3ZYnRKzZf4X2R3HGhdmaXXPC0BM0j8w//h9HScd7a3QHpuj/I6SPyQyuu7IA8N XZjA7iiii5NmoMiQHj4d5tnEmJZmDDrdxvcTO84dhmyH99Aw2PQMKp5Wbr56d/dR lDMidJMMS2HAXTzqcBwjjNEsSq7QTV7IjPxWMc0kviHFm+sNUy84rM2FpuWrJ0lA cV/Oq0dykAFcgN1HLqn4e4Hr+3xomjgYCrIlLUOqTvFFUPhYljMXt+3dTz2YlsCQ mYiji8C8PGIOA4eG23fy9wkez0GbOdSR+U21100YK0RIYXW1axzHKJTaaA/l9co+ SRZlwE98OufF2geKMMrnZYB6qBs= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/07E59509D684597E

http://decryptor.cc/07E59509D684597E

Targets

    • Target

      7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464

    • Size

      175KB

    • MD5

      5a9e750f4d1d2514c496f43b1e20a94f

    • SHA1

      c02a6413d43da9e8299c0eaab2252a20792da5c4

    • SHA256

      7d3a5cd80e21098c2ea4a35396fb9ccec326054f45937eae3207a3f5f2d09464

    • SHA512

      8159e927281c9320422132030847fcbd94c2e322bd6cfac2d0c222e27fb11e7eea956df22785a2b19b43dac5e2474ca06c98e0e416162b75d82392cb730fab23

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Loads dropped DLL

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks