General

  • Target

    96dde0a25cc6ca81a6d3d5025a36827b598d94f0fca6ab0363bfc893706f2e87.bin.exe

  • Size

    116KB

  • Sample

    200729-d7wfnygx6j

  • MD5

    995f73ab9fe101249465c0514da4ec71

  • SHA1

    6fab598e7536cab36e79b7fd3ca6581e4e806936

  • SHA256

    96dde0a25cc6ca81a6d3d5025a36827b598d94f0fca6ab0363bfc893706f2e87

  • SHA512

    8eb0573532a53b82e87741466c57d467c929cb5d3d7de9726e14a7ddae410e1c4da162c21c7cef2c5936ade7fc8ae28cb5e4804399b38ad1e4e0433032c43503

Malware Config

Extracted

Family

sodinokibi

C2

pinkexcel.com

phantastyk.com

consultaractadenacimiento.com

smale-opticiens.nl

travelffeine.com

plastidip.com.ar

htchorst.nl

koken-voor-baby.nl

kamahouse.net

waermetauscher-berechnen.de

behavioralmedicinespecialists.com

igfap.com

anybookreader.de

rerekatu.com

kedak.de

upplandsspar.se

kadesignandbuild.co.uk

oldschoolfun.net

kampotpepper.gives

no-plans.com

Attributes
  • net

    false

  • pid

    $2a$10$6aUNWO3Oael5dlI2B6Ipwut1oU8eU2ii5h75fkQCHve3fscCS5Up.

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome NinaShoes. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4967

Extracted

Path

C:\t7k5r69-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome NinaShoes. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension t7k5r69. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D7E86A3A7D506197 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D7E86A3A7D506197 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8xsA6XHmhAqguOXjPlfumCnjg1iigMD1rc5tacgoRby1XPQiCxb/0rmmlTxD6U1W GzTCrT5KvXSpFyNZYv34xvyaoe0UWmmjqjap8dQBpcyyy8ufgGTZ1zlsy2G7w9It gwdDY68I8CDXoJUMwr4LTRU3B1SVBYCQtsXHY8DsLF6BOyE0aTz9HPwikWOpOGz6 E5lC8jTPd4EU/oeovHnsv2Dz/JNhk1jLlVxmAelWLcnoZNU2OxBMjT0CkjX6vn0k FunoDvyID6H2yoODa0nW2Q7QW6/9AnnUdzoQEVq6MR5BUEVZ9diaj0YooKEhGIRi 9E7YkR78kYaoG3P3+0vYfeOK5fhRxnyCe9BcHtGUxpLt6MhF4YbFw1MmVUed9j8u bK5vHYRHxxBHQCcGbmlZ9P5WUPjKysEUufveZKpv6PGSbomvaGT8LsO44jBRd/lS 4qcUN5Dg4giqrkrsiH4LI5qxeG4KHLl0cVLuq7tOhorZbPwrm4ALHVr/BelBlIDU 2omKbmQ2NUU9H+vYPEvEDvR5YPXMKdQKAC3rqwoy8cePdc/Vr9ZtyR8PdiFOerKN SbBf5/wxV0Ya5oTMqSI5XNIXmGDyODvLlvzCezxOnSQeo7AEyTHbBxtZq3rZgBg0 htEfpOEqgKET/gGrbDM0wIEOVPY5zMfIOYGG+Cz6DSUB1GH1l/Tmlwh7Uh1s1MOh L/I6ShtEMz2ZsqulKAYGrkbreCp8GTZ7FVJChEZvqK5oZ5hgpC7Ct9pr1p13akyK LE1iX0JViuIljNQsYulqNDBgIixD9jegMXeIPtrUjhBWUElEqL66qHMPRh2uLDhb clSCV7BYHlgpTDYjOneQ2fBR1V+Va8toZdrX6sP4Rb2PTwTFnq2O8dq2yHI5sMDg yua0yqEnb/nmWR4Du7H8/Z9aVYT8udaKT4GzkxD8uPOnNgCteFnah0MdGsY2PZ1p oBROWGqncjmGMRf037/D1peGPAi0dWSipQqpnHiuA2NlyTxJnRAOQ3TSPExihPOH xNiExb5WlYrTALxSNWnANSAwNlBjDwhucOqg9PhIbam/1kJ/JXBafhgHckxMw65+ hXxPEACYGlcg4HEhlR4NXV3mD499860iwfuYu9mdZX4G49/fXicysiovb20C0EvI iPoOjF8VqBKZiKEq4msRmQDUIt1e/9xUCqXCOHo6JiCuh7lLWuFZ+JYr1yzqzdvN 0As48+aAUiCx1DiFEqRGEC43Wkq7V+9iU8oazYi5z0cUfBeQo+jpNvrzQYCx/LcJ oZzMwkbW13O3yXuEtnJHQbj/PvwVMMFi1HhfZV9lm6ZtrQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D7E86A3A7D506197

http://decryptor.cc/D7E86A3A7D506197

Extracted

Path

C:\v4up0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome NinaShoes. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension v4up0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8856FFD5E2C6C8D5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8856FFD5E2C6C8D5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: lbwJCIW/haBXzYIePC7Q9cPc7OoyyvZgneePI3qcsOtf8NfAgEUp3p8jqKlaMtCZ Xkqgro+M5OEAcwvIP3VxUToUBGR9I80p+FqmlnDiFqQGLKDTIwFzEqVSM9cC4MDD XzrFIdvw8SYw74kUrwGNzD8CTFF2iwG7q3Ca8os9uCN6xQN4f2My9fwpB5yOlQV0 MxQQEzNahzNMl3BvqeK2yX6POfSdyrXJf4LhB4RU+lAthncrCr4tToskdURhr+1n pbULHuybz9azjJgj74KQatlM1cQvP3E3rNoOsu5Lk3WlqEJMBO7SVfE7ZnNeZXnK TrxLNccYYXwu91ehWLG4kz803fhLWRpMDj/5rUNs6J+pmYZKfFApehVJFUu5FAlF D4nI6//TXBDE2Bf6wJke+HIr9SiB+99nD5+pWZuq/pAtl+rz/Gh68B5Jgsf53B/D VGXEpZRUpcsgznObtbGnYv1rwWJs3pXFF1VsoUapK5jVDK7mnISdQF+U7mW/Zx9Z 0AgF6NGQXhUGH3SM+dCcJEYpybpqZ4/Z6DZCkoVFwzXh4T1nuqJiJ7JfrVuZNcPs Y/oI53n5SMjkfHK4pAsWekTXi1pey5CVvGLKvICjU9AG5MQi0YZ43wDn494szXkY 35Hgm6GmbCE0w1p7YcPr9+8N5GUrjCusy/D66l1NcagnAn+xxk0npMHPhUE3qByM O/YcA+YZ3xSeAb4vNul95McHGAxcDmTNyC3mlZaLc/3bqr9FZ37cEnAoR9Qhkw0R k/wOtAjbsrg9JGz5zMcus4At5H5jB2txO1hAdD7/2ZxlKimV27FU4/XSr3hNoO6z xwKk1mnszDs6bV0+8z1GMtK2D6YVx4NfNduRJwRIVQ0AeYiQe3SUH/4Ra+M5p7Aw rjuh7x7x3j+SVStBkMVG93B2h+cVht07wP9JW2jwWk1s0pJHABjnS72E+/MQ5BPW 0NeXYY9r4wLHU0pfVpNuawjQG84KDtawTnIGWxs695yKtFkuYqNq/txahUppjmAy yPWrL+KHvDacUPBYsrhT2Ij1373QxtRq/KteldW6Er8GYwnRFJwiHYKJVyl2Uo/T EzcSUsM80M/g9FTUhnOcCcuvFPqg1cInsWhDj1TK8rN+KehQ6a7AGSUBOZU9vXP5 X84v4qiWkpPIKIhHXRJ97bOEjRdXKnMagp1ENfNqw4EtzAWQBDiW7pYgIBgEA0Tp IIIy+zqJzIw3v2ihjlUkQsYu9dyjbHiID/CTFDNyloaFQZZKkCHgm0Zk4Gd4PVyP 5n60fYLVBE8LrvMbCgI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8856FFD5E2C6C8D5

http://decryptor.cc/8856FFD5E2C6C8D5

Targets

    • Target

      96dde0a25cc6ca81a6d3d5025a36827b598d94f0fca6ab0363bfc893706f2e87.bin.exe

    • Size

      116KB

    • MD5

      995f73ab9fe101249465c0514da4ec71

    • SHA1

      6fab598e7536cab36e79b7fd3ca6581e4e806936

    • SHA256

      96dde0a25cc6ca81a6d3d5025a36827b598d94f0fca6ab0363bfc893706f2e87

    • SHA512

      8eb0573532a53b82e87741466c57d467c929cb5d3d7de9726e14a7ddae410e1c4da162c21c7cef2c5936ade7fc8ae28cb5e4804399b38ad1e4e0433032c43503

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks