General

  • Target

    d064cc1d0d70ce88dce14f6d33689c5f2622026ae3f6601fa7f0724a36624016.bin.exe

  • Size

    116KB

  • Sample

    200729-5vml39xj2e

  • MD5

    3f5b1cc5a66314eb6074c0f72bbd07ab

  • SHA1

    c26640133adc2d465855248043b971c0f7c77843

  • SHA256

    d064cc1d0d70ce88dce14f6d33689c5f2622026ae3f6601fa7f0724a36624016

  • SHA512

    e1a5f7e452bde40d84aa757fd60a4bb4ca3efffac36e19bba56f97143b2666538d7873249b6f54706905f5de1036e76d2a48917acc92e719e9ebc13808e40fab

Malware Config

Extracted

Family

sodinokibi

C2

foryourhealth.live

mylovelybluesky.com

falcou.fr

projetlyonturin.fr

sandd.nl

bodyforwife.com

macabaneaupaysflechois.com

philippedebroca.com

pmc-services.de

gopackapp.com

shonacox.com

spsshomeworkhelp.com

fensterbau-ziegler.de

tampaallen.com

johnsonfamilyfarmblog.wordpress.com

naturstein-hotte.de

syndikat-asphaltfieber.de

blossombeyond50.com

aakritpatel.com

skiltogprint.no

Attributes
  • net

    false

  • pid

    $2a$10$oE8rI6ZpUkAKq9Pm6LL/juO.vRcKTGe/uwI3sDYT3gtLqj7pyjgYK

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome NinaShoes. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4967

Extracted

Path

C:\304ll-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome NinaShoes. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 304ll. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7110839F576A78BB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7110839F576A78BB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: uaQFvH52paUODT+alra1qpriWXRP+BJLSkvuGNB0AwuII3nkiPgRFlv0jzq/K8h3 pKOdgzV3dy8gDUxy9pshVZYsc704RbxEDHNuiqubbPh5CHiOtlYpKv2RrVJg1Hzd 219F8OC9LUablWOe9DNkw56JuKdbDY81ZIgqMqAaNr5LqFx427jOdQdiIdF+SiZm 3rIAyZp9gB5Kbb5DEmfhrNGMPo9VMByh2ZpsxSPiiNmjeTKRryVD8n20YAnUSjRz krPw5HbGLOr5/LI5WKWwyJz+hL00Z3wNnqsW4nHjlN5vP1aBLISPGPZoWF8oMRxz H7ZobvEQNZ+EFk5gocPB1snv2QPoSP+x9i6oa4Vh3smqfAruFG4deVA71VB+XrHw 7LF2HJ7LVIuDBF7ykeq4wKZ4t7lB4EfI0/HUq8TzeI++dQDclmmy01ZZkDiX0BBr sdmiMzFR8qMTegZku6nV59Rh1pRF6pBrOm5PVDqKVf7UXtcgS9AnwAbezqsHHiRl KF73Z9hJnYiwwx6E+hSA0+LgJGd8oenWxTCnbplGLLEmwcEhZrRs1Jvj3F9rnIeT rMH3fPH+kml6NLrEApCh1uMpbGCqV5N6R+V025VpO6u8Q/6Jr9GBRJyioKTarE+h 3f1+NMpYBZmuK+wlhhqpbOpodqb8W2z9Hh9BpEQ00xhbH3ZdCeDZN3ZzWzaXK4ud bgrUCm+z1FjDpiS/CdJjVxScRPwngW3hLFvlZXkwZ5EyMGKWu28+FJ40Z6lWG2p/ pGYv0sXN/W2aN8ebgvV6uDwL5bCaJ+PyR++KS7b/AArvFCgU6RC/VHRtaJwDN03w yy1ddotxewIenpUkh9SqaMc0diC63sis5YaaiJiI7gPaIZKNkyC8SJ9iK52SrDyF xyWYRgnohZ4V5VV7PLHoWSffctMUlfDFE8EZf0yrAAzdfMvOfy3N7pxSfpEJ6pIT 9Jo8oN5LHV/801MfQceWYQMdukFhxLCeLxG/IqlgkAlQmNCJmWdBREk6ELO5Yhz9 12kHIxjEC0tmF21wvDyPB3Zk1IpZ9tRC16wgIjWHObJWYeD1Al4Tbob3hWHPaISf 8/h/ZaEI37O9hNiCdUNPB1pJeS2RUxfmZwLS6eiErkrSWT7lQjgEWq8qc3un0ryR gn+toalDWkeVfjwMZE7c7xslUeDQTNiPeOikhYPkvP9RfXEPDY4gNp23mO6NBYfv K9GfFLIcfUGciR05RgRq44NUDGZ90KpYKmzy2IIDpy+w1oETUIxadvcCZaFcMGz/ gwujYHzkvMMrJm9lsmTXXVEGSu+yGjaQFcL0Ui3a ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7110839F576A78BB

http://decryptor.cc/7110839F576A78BB

Extracted

Path

C:\a5pmnu-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome NinaShoes. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension a5pmnu. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/707D6E33588463F2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/707D6E33588463F2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xH2ZTkStjMVghLqcWos1vLYifM0nhwcxrck+o9rPSASckCwOUuftyWn2sho9ReBn CwPj1BNFd3wlKiKCNJ8OQucKi5BhXrgqj9HOM0CpW5/1IoNqK+Gg+bBGl89pkhxv lZUAjIWew3LM4yssploeOYW8NCJMhsKqzb8684S3pW3otw8RZHmrF7BJpZyecUfT f5NDGx71N0llNv9rDUcZSQCB5QO/IVMKICoCYmU7Xi2vPnTb1RkL2Peowy42UZ3k FQhsOTxaiTk1VV6JfbAj5bn+BC6Flzb2Lbhs6Xt1w+cthva8DKWKyKgdyq/60Vfi dT/QCWYQ9g8+EpEXb07kEZqeK7OK6XUzC1jAhZkJMvanSpdrSldc26+2cRre2WID Uzj+zY3qYRpIeGsZPPja5TZTMvmKQEuud4iYOE5ktEZcEajQQu7VjsddlshQzoMk +W/KW9DUDWTejqpoA+OFrly3/dOKgwn16usBxTcB/kh44uaBJWnLJE5YpY4DWeG+ MMYDljfIR6QJPhPi3ZP2tNieLUt+oj1WCTBhS3u/+nFmy4OBi3QsMnwx4pk/Yq5f 6wShf1k8VT8mxNeilrvBJq+kAEcieeZP5YSUUiCBUnRNKTUowiw6ftlZNLOgu7fA CHPdCGn+J2FBS2oYTYIuezfXgYp8ZdJpkKXsoLlUB+qbgboRFb+YvouRDw2U0l5E O+hhBJBHXOGl2vbZWfDhM87BLGpSijMmIhOWqwzV4d4djhmCrYoGH7iA1Qlj5pyI iUk7sVsOeVUSljbD33hBJtWGUCkc9s+dfXizFIFyqlyipTOlH4ecaGkZkUEuUMvY dc6PjSk54cWTmeQQoD3X7YTvDHVKtdAu0cM9HZLZqF0aioX2UpxXGQ8pxV8o7yK1 wK3tjt0EBaexwOKdk61bqfHO7x+DxsDbwZaG9xXKfB8SH8Dnl64Fdve4unfjawuE NM9aOc6+k/74I+fEDDUP4Pz8snvr8OV4tyR6dxZbHcM0R3BqlqzrRmoefWP9DR/2 jBtpSImjYD5LKMN77KC+2FUWQjTDfzqXMxE1b8NOeUCJqDnjVcVkJ9Odk6TUR2R9 WGb2OdhdGUtdbpUHOSYLHgHcI2osCSwpqMsWkKwoCwjFiRi8j5UG96dhfuQX52o7 n6ItzYoh9v+++1uej/jtgCF5EWyV6cVEUlPs6XQwneTzdhFu7HPqJSFfB+/ne78w eZrflJuZ6NHGyxdNOm0DYgaXvZms/HGf2ADJeIJTiY8Uz5XOxPjnggwnqU7XRJxa 3SMeYp3e7t4dGCL6Kqn/OA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/707D6E33588463F2

http://decryptor.cc/707D6E33588463F2

Targets

    • Target

      d064cc1d0d70ce88dce14f6d33689c5f2622026ae3f6601fa7f0724a36624016.bin.exe

    • Size

      116KB

    • MD5

      3f5b1cc5a66314eb6074c0f72bbd07ab

    • SHA1

      c26640133adc2d465855248043b971c0f7c77843

    • SHA256

      d064cc1d0d70ce88dce14f6d33689c5f2622026ae3f6601fa7f0724a36624016

    • SHA512

      e1a5f7e452bde40d84aa757fd60a4bb4ca3efffac36e19bba56f97143b2666538d7873249b6f54706905f5de1036e76d2a48917acc92e719e9ebc13808e40fab

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks