General

  • Target

    dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01.bin.exe

  • Size

    134KB

  • Sample

    200720-jarkvlsg9s

  • MD5

    b5d3505a5533c63d9e12b4ee1487febb

  • SHA1

    546c127f4957aa32bf7c5f00086cea4fc3da7cf1

  • SHA256

    dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01

  • SHA512

    2a49a7fa24300b090bc7bb44485e3072dbd7e773e9bcf7ed0f622e113856de70c4f30faf135f0bf490e6e2e3598c75162bd1b5dfd17fbd2e41e548967ff2f53a

Malware Config

Extracted

Family

sodinokibi

C2

firstpaymentservices.com

krcove-zily.eu

softsproductkey.com

naturavetal.hr

corelifenutrition.com

leda-ukraine.com.ua

beaconhealthsystem.org

acomprarseguidores.com

extraordinaryoutdoors.com

mardenherefordshire-pc.gov.uk

stopilhan.com

triggi.de

anteniti.com

aunexis.ch

boosthybrid.com.au

bee4win.com

gadgetedges.com

tandartspraktijkheesch.nl

8449nohate.org

simoneblum.de

Attributes
  • net

    false

  • pid

    $2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

Extracted

Path

C:\50139b-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 50139b. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F5C41EAFA6F69A67 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F5C41EAFA6F69A67 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: J6UX/vbeyp/H/AHkXQ4LR4l+mLC1hKEdqo5sr4ifG83RkURxssIUrLHOwDzIU1u4 08353GwbjtvNtS/ZxZNj6RIsqZ7b4Qz/wsb43vWuwEELhZZfx9zFvXDryFOJHrBL /G6EGl/ZiuP37vQWbVIcfs0ZMUHCWDYFXhc7CWtu6tFs8q5Zj957dJXmtaNwH6Ho /9BjNibCx3kc0u5ZykXkJuy0BKHT5sToBVafi+w9HdFbEpshabGdTh3XCUhc42ns +iDzLjfEiJp9EzJnm7b17BCVMpXtxI7ATc+8aLr1DvwQ496MAEoTeBw5N0OEhv9m doby9r+OD//merEr0xma1Nkgg2BJ3ZUI9HhRlSPcANG/WTjETmmI+m3QpMaPR25/ 6FsK+dJv1lFhgKb0yrwe3eNw51tBTrTQy5lvnWCso0bLKAUyR1NmjsPS0YYMnQBk MLjo/ZudsdfWYIOJDhQO0xb74DXP2Atg7r5/mUCJIcqwtFwX2SYeeK5TOuQbOWRa B2UPFDz7wH7RGAsjnFKsGSQB84VfAuP6re2eOa+YgVDE+Teev+ZXtpDsIwavzS1Z eGIokpYI26dGImZuKZMYRAMO88EU5hLxCaBiy5+jvtnak3pzhvk7v7JOI3nSymcA YebsKTluHzvR80HL5fCYWFpIEG3ARZn3EiDo8KML5/VuoVovN1wY3sK91oZQAvi5 tIgTN1VZQDAdMZWvvvDxYzWf7EHH2v5KHpYCT/kiomX5i459p6tWRUmSF3HAo2JY vyZHP3YATND97GYFylRQ/w2elMmV9n1vANgWmtWTh4Mr/knqWqzlKc4DTJHUATju JWyRvvyQlsQVTPNxXv8LzrBqoQuJfsEY7vgiozfFxDnl4vWyZzwFTnMfOe1gVf3w EzCmcwnXvC951gb2Jb+rAcl17J6/nsC7ZTM/EZVLSeHjo0nn67xDkw4TvKEjrhS7 zgn+o/mTmVFUKFjxcch6ASvQBDFnABj+9MpDrkVl/xi2HUrgtRBA+StivJX5zWrI sxMK0rhK/RiR/+LtGz7CdY6za6pPF/nSAxMWDWPH+r3SBgdtVj453kPJn9qUmsQH m1LggvtQf5iKsvj7IGyFlCgwOFxYDjuE6bXfPy2CrpXUlKmIawV+nbyaJDygcbKw HJ25gDQfBIBwc1TbkDEnxfNIvIaKneLIot7e/Wghy+TQdyHMa652smkQLXKy09cu siUp1olxw1x+CkH02wZqEoJF4zvYhjHEHgHdzkreYDmli/MHAXQNMaJTSelVF5L/ LW7iOTc5oMKQfrMHpr7mTHvs+rDlprHgdPO0e6jF3ow= Extension name: 50139b ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F5C41EAFA6F69A67

http://decryptor.cc/F5C41EAFA6F69A67

Extracted

Path

C:\418ns433q-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 418ns433q. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BEB8AB4C5AE06882 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BEB8AB4C5AE06882 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IT0Ug59g5muWi2ugI6OtiWzIs48yQELvGB0G49FHABvnhnr/VkVUTMcXQFjW/mAC 9ShL/R3m6TBZexNSVHviOwb1E1hz0hZk4YPw5foJClLE7mReX5JBP9OdfKDH9JBn jLr8Y3XvPu3rd2VLEYtTyxFnhqfI1d6QGDKoHzZXaHHCXW4b5s7CzoEXI+yvgoq9 diT0qg992So1yFZc+msptScO4H4yaYK1buTWqF8k6LsDWsHhzc193KKOcSCs3UDM p9+lV4i/sAli1319wdh4vhzww9kvD5CI48/XWYdMif+ertlpWr37+4o2bbyx0c1U U+4TMDRYjLsZAf+dEm3A/3BLeNu6LcKt7AQARLBpetXDSvBzz33f15EWIkEKDw2p T9hGYMnplxbDt3GBjOoTAAIGKmcwyL6JzM2M2Y0zs/iKbgkZyCuknyd/CjvnQ3SP FnnGB5rVo3slwNRFeIWpauYvzL9ArDKVdTWZDwWyLpYTaulzYrW2H2hJol8XEgag DpEVyULk04H8xwO1ffKtBpuaHjUHawOtRgOBANtvcmMQ0hhOWJXaQ51AZzVrok8O /hcQ3H4BNTXT0P93lQAonuCnSpsJsdUf5nsVQ5U6lOgmhomlx8C8Zx7VX1eKOu1m Aq5s8M41TfQl2X2bri1wGiytresHR45Lfb1z+nM1Tc3pbT6PldGvngoW10ipNwVr aXmJ8D/OlWSEhX7MzrN7yWjaUQhDZgKcM3CTzK9HQHe6z6WOTRlzUdYlJhjAdhcr GhkcVoCnzyobXqgG+AOyrF+50hSmO40Xr8yChCHjYp5Ni7mXiuCjVS/djry5y0gt vaNlmpvnWQ0op9ABPcA4RUL/SF+MhUFNNin3E2xsbF5K7X6n2ogQGHZVxpjaN13n 1nNBvYUSkcfooQ8vMIM4ffN+TKUlphTs2aYxgJhpeQ8ROf/QdzprAuHwrXDedm0F 94XxlwLyZzOYSOg3v853MT1z+ericqjWQA6VTZJIAKGhk4+hXd2C2LjdFC5SlpTN bztQOWoGWE2/vgRIbLrcvXUNB5PqpiuhVEZTZ00kBT41s24f5nwZmvo0aLbxI0vO gNgG3nx5VkCuXCpsdLRCC/mVeBPsGwMGuoRvC/yn2v1/DBLse/ZM2jbzrYvzEH8T nffOgfRwpg0oI+j8oRViZw3C5aTNCAmOEEPOcByCBqRDXD1bqDpr439s6vSdfUs4 UPbIG7Kf67JK5eX5y2jZ4wjGr8iC+BSdoXp4yeKCmxenZKBtyyvUnNex/nWrbsYY diyAd1s2iS7XXkudt4BW6zKWVJUtAA== Extension name: 418ns433q ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BEB8AB4C5AE06882

http://decryptor.cc/BEB8AB4C5AE06882

Targets

    • Target

      dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01.bin.exe

    • Size

      134KB

    • MD5

      b5d3505a5533c63d9e12b4ee1487febb

    • SHA1

      546c127f4957aa32bf7c5f00086cea4fc3da7cf1

    • SHA256

      dc732c1ebfd20e219236289f1815830abd704bc340e8e35966754666c1a2cd01

    • SHA512

      2a49a7fa24300b090bc7bb44485e3072dbd7e773e9bcf7ed0f622e113856de70c4f30faf135f0bf490e6e2e3598c75162bd1b5dfd17fbd2e41e548967ff2f53a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks