General

  • Target

    368dfd0ce07c2010b0bcfc05b60c653d285b9b201c0da60c3be6f6110a89140d

  • Size

    132KB

  • Sample

    200706-xlm5bwxl9e

  • MD5

    8ea56fd712f728e5ed1a7dcba86ca9e9

  • SHA1

    1ed11049103a716f8a21f0fc7bcc07d20090871e

  • SHA256

    368dfd0ce07c2010b0bcfc05b60c653d285b9b201c0da60c3be6f6110a89140d

  • SHA512

    fcb77610abde19b1bfa8c805293e015b98a65b6845f241bb8a25b94df9c8e3f7a4e8ce95825530c72118ce57d907f6e43dfb273127a40e118a446e81d3a86a13

Malware Config

Extracted

Path

C:\vmg3b-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vmg3b. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CAA0D55EA93F4A25 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CAA0D55EA93F4A25 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 285hgKJqoGhUUytl9eSDkzSo/kmXCWmnIyo4G4Ur0FzZxliGvl7lrfU1KRTTvF3a ilXS4yV8/L4lt1GJszsGcnaaErpGyGHM7vNV1R8Y3wgdVOsLAupq+0yl3wZa6sVo NszzUzWjk+sBqRKTgj4cTFqZaF20Uo8RNG/2SoscjbolrHgSI2U6ySm5+1LjZMqT 5f6o7ETZL/HhRv1MqGBlp6TprXZ7Gtr1EtaAJvXSuxg9CrI9umDW6Xdphhsj9JOx oELPh8QBBr/to4cq3MV1FAsjtVCD4QMok2t9SjnKJyMhF1LFem6B9WRY9GFxv73P 6J455xXb68OaGay1uN21gjgZYlwTcN3LRmneSOYI+nsRmE/hb92DEZ1/ctse1fxL 1q5HUQ42f2UIpsljuiQl9AhQsH9PXLhdSSpAXJOZDG1p3qwaDM07fJ/BRvjBIl7u i3+aFXpAWi/tr1Io9ZDrYncAloWD15VyKVKRjPuSeRawytVYr5IrKqWG2D4ry9jc SKoRtGedAxTJO9ciVtHwaQRAVACkvBGprHWp6tiTVLmocA9I7o5dC+/4DKETJWOY rqLhZpmsfndUzGGdSTR1jpnmNGFSJ/jdqAQdajMHJcjb56PdaPUl9bqmATX0haPV xeWpC2sDQtmXMml6FSPowARACxRL55f3JiLkbfnF7jdCqtLIwC7Trii1gcW41jYA iINcTutmy7yvUq3k2cKzPhuM5vWPRCFKEoH/WaS2TvSJlE2VqpJfMqPJlkAlJlV1 h3ffGox4mTvRnLBtiIPDJ4MmNy7FkPhJFZUBmiylyddPI5w4f+EupkbsrlkDzK8h O/+j/iCfEgC9POZgB+iyidFxcWgJ+NFgdI0ernnR7vun8lDOKBXz3zZngO61/ABc avjVGe35G/lgf3t5f1vCQpGuiT4hPvOMjl0YUte3GVCmnO7qZVlp8iQbql2KH8dN 3vBOCcdm9cdLgMJaLQkI7eLcKYSjUMYw+6vZvhPZ+vRuiIQJR1W9YZOqJ8sfkfry LxlqDRdAtNFZ9cRg8eNZcwBOq1+hRvpVACxoEAH0BG7hGnZiNNK6bUY0QWKusUDO Gkj7jX9PJ9TmzTYynFpcO1HKTMp5sMGhGw64+iB6wCWqzl9/JbiUlpUqpZMw1xRN v9tkelkYEQTaMLRxSPGzGp45NbzZJPoTPFf3oYnfaMIGXi+uoH3Yxj4s+MgyJW9A f7TnjKOW7860LsqZjrxRAZOpSkOIwCvCF4RsfCieaMBErSORN3LBCHxZ3PRo90+B nsVx78QyLrf4AkdtxLg/B9L5eYRbjXOOLuZ9nEO+ ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CAA0D55EA93F4A25

http://decryptor.cc/CAA0D55EA93F4A25

Extracted

Path

C:\tl794-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension tl794. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6B16E928B6458240 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6B16E928B6458240 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TII1FUiwqMrzoo7QT6YutZgSUIDGPkm0v4N4A9v1YxrLWI8stol6xAfZCmuuOt/T PCM6yadwb421THPLAxOA9EAoXr/irb4I1YNZozYiQknppDQ3ZWBx+AGX3dO+Gcag ZUYeT/RZsOEMJ/sc4gxAvpZnNvpYk3bsxxSbOlHe3ZETpo2MAEfPuQ/zGW50EXhq TvYWtQqWZWT8o29dEKexglxj2sSAhrNScAjERlBpIalxkwznNQwS0P2H7369Co5S RJtRUppOy8ZbcP6Jpg/yh7b0VAkQtMcttZqeDyreeEPzz7as3zr+ZK4TOiEVoQg7 Q9aNDUHM4JJMgg1yTOydGuceW9xvkn8h1ibDHuQtfa7bm82Cg3g7YTo+Ek5ZKRMS hiaNTQ1aqbtzOUYdC5BxzvJLdUyU+Xd+MHIW7BvAtygoLYjYPRMyqZz89CzfRMSP 2EVnC50nAUdjXwlG3wsOygy2VBQmyj2OitAiGf4VO93MEuHSIidiy9zxE54wOQ5H 1SzJJM9cmotWnh/+aTJJozBkCVqIgWPI6oATBgoMfK8jXQJWSL/YfU2UWu4mhiTa sPUksWavvQBTwjHvkpRw3fVERv0FEEvFbKoGPzBaaVjU2dP6ZXw8C7QU+HfI7dsW QJZ0yMSreGp4EVieMCa4ZcJHBf5SHsaVYFkHXJgQAEaIITQlxJHuvCJ6iQi4xYAf KEBcl4NchVRSXTRab8MlhCRbk1TjW4B42S4AJEjssYQ8Z/7NPRPQI8eRCd+Hbs6p HljYGwYwB4ccftB90e32oBe210bGNxVvLA7CN4AgviU645dr1vCXcWanGrC34yco iwAEE5YXSBtMkOmRikwnmxazDqPPMPT+87Hv/+6fHDwYgyc1UUL4Cg9+4JRnhu8V puYLM3K1xr+rVEtptTCCKhWTenZfA08XqEYHYXlvjpptsAAiDFvE3aQ7xjrDXUfN rd92O/9mihjB6k6SzfcNliZAGcYQ9yRq/MPZIf73yg6sbc53JjJGv7PHQV1nWYcZ O8zdjPL1EEWlAJIlJ3UGPpa9rvkAvtryUcVbnMvru80kuo3iF0MZnetyoF20fa79 p0ZMYx5XmZh6Ks8VsApkriX2NdUxng16R3iPoiMT9WRJlA7llVHXfr96jmaD4a2d XYB7GbYVpA4drR4h+CVF1eNFmOXXrJ/fdoxIbNd+0epC2cx4M4Qwp3P8nUdPEeEl aD7WyAY78h/B9Q91ngucc0gL6zQTHLEuc8cusD9gn5fY4lf5o07tUr0c6fyGuz1s a7k0eyJNVLkBBFUsyBI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6B16E928B6458240

http://decryptor.cc/6B16E928B6458240

Targets

    • Target

      368dfd0ce07c2010b0bcfc05b60c653d285b9b201c0da60c3be6f6110a89140d

    • Size

      132KB

    • MD5

      8ea56fd712f728e5ed1a7dcba86ca9e9

    • SHA1

      1ed11049103a716f8a21f0fc7bcc07d20090871e

    • SHA256

      368dfd0ce07c2010b0bcfc05b60c653d285b9b201c0da60c3be6f6110a89140d

    • SHA512

      fcb77610abde19b1bfa8c805293e015b98a65b6845f241bb8a25b94df9c8e3f7a4e8ce95825530c72118ce57d907f6e43dfb273127a40e118a446e81d3a86a13

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run entry to start application

    • Enumerates connected drives

    • Modifies system certificate store

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks