General

  • Target

    fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

  • Size

    166KB

  • Sample

    200720-gpkbnv7ql6

  • MD5

    9c21e23a91e0488d8df5e65b5d29a2fe

  • SHA1

    f032814f2e072178a0c20d7500c2e1e4352aca39

  • SHA256

    fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22

  • SHA512

    6a9008181203b1d02e62256c62d41e6788caf16b60977ff796bff8b4c42efc815b092082ee99d92d459c54f3b6e440ecfa16d5bfff9a63aa099f48ba20fc53b1

Malware Config

Extracted

Family

sodinokibi

C2

lorenacarnero.com

resortmtn.com

haremnick.com

allentownpapershow.com

idemblogs.com

toreria.es

boldcitydowntown.com

teczowadolina.bytom.pl

faroairporttransfers.net

rushhourappliances.com

mediaclan.info

digi-talents.com

xtptrack.com

bridgeloanslenders.com

gopackapp.com

rimborsobancario.net

almosthomedogrescue.dog

forestlakeuca.org.au

tenacitytenfold.com

theapifactory.com

Attributes
  • net

    false

  • pid

    $2a$10$umiybwuiiY9i8r8VBXSOi.CXsHbB0Zx3GSd8GbYRag9aFCNsAJ43i

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3979

Extracted

Path

C:\3z0k6i-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3z0k6i. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C2A8A4171253212B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C2A8A4171253212B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: o/tihtdrhzaQcaeIWOXXJ6FUxsN026k76mK6Rp0rpNxT3HUtD5cgZSLqaq8znKx9 NjhRsnmeofOKpWWeXeMrZsz1eXm/es8CkKT1+kFZoAY/kXT2Zvs4DvTIBwpw9COy LXVKvcimJT/FAH53GGLFkuozbf/eQ7Z11Ugy7+IP8mhb/Au4rKQjje85lJ+2DDba Ihe0wucShyna4qe8K66vuEzwOTpLuEVc1UChpBqudWDEqU47qmP27rCh0GzFIu79 9Fk3l9p6o6IOtuHlXmJ31HTGVM1IfR5r9wv8tx4tQXuNZoiXvRR/J1KVqs6fAgOT V9wM0DCwGGN3Lm0nrDOKYz49pgXpXxDc9Al8O99PIdjIkbsuxujDWkZj89PObBs+ uJH9r+03/tedlUY8CTFxgIA25e5cLWOl3gwIhMF+G70Ja9D5rLrEx/sBPH5iqnxK Q14t5dNoXSlnMWOqGqzdxdg9R+2gWU2drAkAh5bHdF4eIhegxDJWk37V9UKYVHwe 4mpblY/bc8dF1ohEfKpvlKzEcIZ2MbFOzADQQ05mjjTUdnxbohjRb2MdFelv/by3 bqo1HB/+5p6LNM1qW3h2+Rev1oNhkSqp9qAnkemiAjVB4LvT2evuPSe351whArSw rXF3xoWk3/m+im+YoVixMwb7Yb69DpZnsp9jeNzh78VIf7Ci3pR1W7kL/YNcdwI0 1biTD7uhX6yFGnVkwkJ4X0b7ZsIp/1zlWG3OtYfxV28olaJ7D7/V1pc06yzFx1VQ lpg8QXFsdNC8OVb+loNLRZwXwOXp6rREbUFaQLviXmeiSOV5TRNRBZlhbKxVmKbr c9BWnuB8qC8FawTHB7/+62ix0azjJeIj2SkMWy/w+oAbwCiS/349mFTKDaExckaI kRXaUV3Sc5V2xb4PbcffZ1WDyXCuXMj/d+meHIS4a6qovkFDMVHy1uWz7vBRN8jp oakKJgEk0NRico4Nij7dTd5kj96Va9/WMs7YWqJ1AJMaFCkzWuXJJLR/AO8kB58V thQzvgwOVmLIoJI2fwipnryYdCQ3SdQlmUiYXVts8/kZZe2KOLVEEXlaxolRiwlr RHqu8T8sBb+McM8P8FEfyvCCMhSHkA8UeJBrTSpAnhRPDeXW814qK5W4AWvGgW3Z /vJgxfZzHqVmGtiRRCKZvNvAql5iwm4tufbSYiLN8pIApNzujjWXOikQv/Hkqmi/ HKgcVW6lGf4SaBZGBEPGsFh9uIPIwLZtbZbNhwqLL9oimz1X79eNuzy6/CM1Fhnw wVib1Hx+p8hL5NcIb9wmkqWGoCAJ9zinIPOIRBBqVMI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C2A8A4171253212B

http://decryptor.cc/C2A8A4171253212B

Extracted

Path

C:\06fp30-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 06fp30. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5755C63FBF55DAB7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5755C63FBF55DAB7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LOgY9TUhPIdz1pMOTQK0nw1wn145t+TlalqSEvnAa7AiPkS5yGTLLCPp1ECioW1o OBkXTAX655iSngyUEdkaV+7UgEHkL7aBza7wwGOl+ue5lU1veRITpvMNQlo1RNds tyFrX1U71+O4Lyr4vShHLi7mx/vMZMXNaH3htQ6/cyRHpfjLec5C5O/UkkZDe0V8 NHbJjlmSdXK1/l9/c8GreNK1IUBbJnNVexXfkdWicbabt9hbRdqUoz75xEQ2TOyV 9gzX0ye61foBIFbSQUDqlqqkHqxT6+Msg6uMsGQn0hEoDyYcFMyvXRuvfRq55Cwm vJJjTMm/e5Bg13zCGnMGeKwZO4869u4K+snIDb11KBA8aD8zzl3Am7qZs9PP+U7K kxmSncrX2aS0zZGVMJNM5Q5p11ZlL1Pch+OzYLbVaDwSmnsmAGQEbBTidOMPys1x rNUnxJMaaVIi5AxwVKhuT8D9IrEQYI/4LmVSKfV/RxCwOnmTAEI5xgF0INphUaT+ gw9j+LIYp6jk2LJIsHpol3NrhaqgUhUlzrPyVuBuaMJ6ZCLmAgphr9DTDWJgMOIn MDZdZDlWMmAtizfrXgbv/fQA6EEmS5FCnz1w1hSAY0aiNo/MBQMK4RI9x6tce+2h ntOdvuyoJXtFpUOHVQ9i8tV1gmMddKOGrBKQj9NKm9mVmxOXVHWVASyLuNUPVdvv WR1FAQLYUsM4/A5w+EQ5UcTK7TZ1sgw19pfRwWtm8f7tN820crCCUNJbEN8hdvpy jEnLplzvyxl8DDMu+n6tRRdcAbay3pM+3BRxVAGFZtR2JMx9Lui6jAtpgntHmEDD 8HTPNhSQFQ7AV0ZlQeDHUyYUPuQ9OgF4oReMP2zTPw19lRLOy9OEsYnETTydZCmD AXzlaJy6UwAthCIqEkiQQEp8JgTgBeccmWGytOF2kIEMmwVSL20FLRyzTSLRHcBb /DP3+halRaIOJw2ck/DyS/oqDkDNkedp0RXpocSKSarmRf/aAeAHYz6+9noS73ZS Gt6K0PlTzq/4OvLYV/c1FGfHdn0RIEqTJ53/Zj54Ggwq3U+dHn8C+LR8wGQ6PHVB P2W8QMUsS1N8nXeTfkddNJ+LqsIG3v7UtnHefNQ+jbrEbQ2Ee27ijlxT9WmP1fKl 3+qcZ3S4jeyXzttoAGTIZ8/lXOXQjkp/hZ9RImA0WqD/MYZKt19ss9Ijnxl/sLUQ r9N5olUCFHqxICD436QgY8gYTE+bjdOuKmokhpAz6fa3bS1Mz9hkcMbN7WNjneDq osIPLJGdEkZc+5fH5fSAIA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5755C63FBF55DAB7

http://decryptor.cc/5755C63FBF55DAB7

Targets

    • Target

      fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22.bin.exe

    • Size

      166KB

    • MD5

      9c21e23a91e0488d8df5e65b5d29a2fe

    • SHA1

      f032814f2e072178a0c20d7500c2e1e4352aca39

    • SHA256

      fcb9ba05f921f7af41dba56b278c39715a8631c27048c70d098574e7ec20db22

    • SHA512

      6a9008181203b1d02e62256c62d41e6788caf16b60977ff796bff8b4c42efc815b092082ee99d92d459c54f3b6e440ecfa16d5bfff9a63aa099f48ba20fc53b1

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks