General

  • Target

    681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191.bin.exe

  • Size

    135KB

  • Sample

    200729-ggmbg165pa

  • MD5

    c77bd2ccabf797907546b37f1fc710b8

  • SHA1

    2185a4adb041f3207320fdf80f4125d00cd135ee

  • SHA256

    681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191

  • SHA512

    e4585de808ac7313b7751ea91b0407628d508329cc646215e5df2af967d7c0036d3c0c9c082ad590e716b0a8fe9e64a8050364db401a3453980b9fab1eb15a21

Malware Config

Extracted

Family

sodinokibi

C2

ceres.org.au

porno-gringo.com

polychromelabs.com

offroadbeasts.com

bordercollie-nim.nl

abuelos.com

dushka.ua

lmtprovisions.com

actecfoundation.org

greenpark.ch

cite4me.org

imadarchid.com

thaysa.com

mooreslawngarden.com

noixdecocom.fr

poultrypartners.nl

tanzprojekt.com

partnertaxi.sk

krlosdavid.com

ausair.com.au

Attributes
  • net

    false

  • pid

    $2a$10$oN3maM3VgOPSTCgm0sjJ0ezfKHMWdW4Ok2QA2o4CbHZK0g67RSPqW

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4983

Extracted

Path

C:\2t86oxx0h-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2t86oxx0h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B367BFA2B2281DA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8B367BFA2B2281DA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zlAlGcc34hFef+vnsbQ0UekbT3E3EU8Eh4sGMWyvyR4FQFO3NeatZ+SdlWP2ZQgn 2G4MhPFiU7OT/3XeGz/qBbNMxacf4cVbDdI87wBndFAPbv/yFpLGXIYh5vIrg47y g/FMFELeb37phSmUHU5KL2LbfTXymOOvUR2yF1aNjMSCy1LToWqfK+/0C4gfj9bi rXSZ3FK/P8N2cb8HvEJ4/1sS+pBlYRV+siwsiGYJOHe28wNNzuzkPyQ6l23lUAte 08KmCe8hWlBrX52FwSb2JctQAVlsmZQQMKJiJfjfLTAzMsSK5Nxmf3NVJwfyf2Mv LE0CiSQqg6GxN3CoJBCiSmzQmnUgrFRFLvPQ3u8wclGfeKdFFxfzl2W8sLxaI58Y NTkvv5nDHX5zxIls1dfXzexuLNWampqPASDL6Gtbi2dgirC4gHB0r2onAjKlJqJ+ /m3x9iI7pzeQHtKuqWPHRPVjywuTtqyZbfLhgpdILvdsI+hEhpGEs5z7qsgbEZGZ BMyrdG+NsPjRk1VuRZs7k4EFkgqb5N6Zi0HP5qsUCo9bh1hHqxaRPfttecLw0Un7 vZTOm84hAhntQlsqd8r3QAfYagkAH4vdAiARhQSV+8IOWGNZm7PSb9D9AMzc0ESg 2ZV1DWsRSNiqy6g15ClD6CzWWYnHUgXj04qfDqTRAE6i7ZvSoo7lyXlGRQv9yRyd 04PdoIo3YSJ3nXa3s4ApEeg5cciCkz2s2QcPBc+V+jX/FGglhKWrcc2crvOc+W4i GtoUtgMet3OOlh4OLF65u1ygLkG6w3zIp3bxRlDMknwOGPBksP1bgieF2qmoDA8z abKB7KcssQP6PmRqS1FhN/gbhx2mILkscQ3pXQZeYuNCVbs+BnYkZAlBN/tKm2uu gUULQRmWY1vWZqjJ6VGYLx7lDd2LbdeZALCys9heK14xhkOQiDwfdpTR+XibSCvC knCCU4rNmZv9vS1CmG8XjzjYy07r3NEIjiBRDd2cAJJpcBWCz6rEIBCtfNjXQl4g 02tkXuy53Ya5ot7pOCv9gxniJ5iVuuTEydHGqkIsqAlcxAxyLmpuqaLAnmIK0NgB wQqJELFnE15PBrtFzD2Xi3eAGav0s3CRtR80ibMKJ8XBay9xwEnR/0taRh+ycdU8 /N39svwaCNKZLx0WlUfwzY4CUb14b1vVItbpSGff4xqEjKV2Oh/oZcd+tMzI/bL5 u/1tyE/JlR1gZ3virtJwBAj+3t+wSfZJKQ/yQgK+0UPL+qNYgOLKcRyAwwmTx501 sM+pR0qOw4UnFJAlDvxT1IMP+6fGYw9s2zqMRVzC+NVeAO3K82g= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B367BFA2B2281DA

http://decryptor.cc/8B367BFA2B2281DA

Extracted

Path

C:\ywh3ggtc7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ywh3ggtc7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B88B78F402F5B52 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8B88B78F402F5B52 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yXpaFQfMNTAVBQ/Xqv4V8WzjmD4tNNs1nah1468CT8fUVMvHJ0mOJ3IM0Nl9k6dt pSL8lONBIDd93KcEYNTO7hYBEpvKJlnv5zND27k9d+awnW9ZS08q9SWzqe8tCAxv 4FU6n6iH+rR+l34xitNIxl+WxcSUN8zfPtfGo86mc0ABWzVNfwftrqHXreK25fSP iX7RaHIBNggFnTtEF1uxgKxOkkdhUhR8dOn7OOHH9mqPNsyM/XsywGCZcp2DBkpg iNIP7SrRUkPuHdNXcMTw1giqpq4ctCm7Em90XxdZyp9E+Do8u+0pfcN04+H9qZ+A qtReuTRLG+kXfeN68RXtiXYKSX9fg1zpvKsH3EJtw/RE+V/KL25AfAZ7i7g+hE8q mdkXr0BnhL3+a/ehlmbQCi2KD5eCxJG9+A8RDoFdnbiv4jb+smCVUeqJeDl3axC+ xn1sZttq0BzifyNmYCmBr0/fpcu4qoY8EithaKa8Vc/9Vm0zzIYavXZJAV8/Q4/9 69bY+YcPouuLRDCS9cgXDdvsWT/TgEJFl11fhAftWvw9KcPnaQkN7rihjszoJ3d8 S9I2bnM0q4jiUBrxHzdFY16Lnd+qqBazcFL/mi+4rwhsiGDLrSmUCSU4chZjdLpP 1AvcXqI0xhK08aDOOosR3n/CzlCZFV0ZnouNHnaSG6AqAy4y1osTNXQlwxJIv1Y8 Myh4nfrKIxYfu4eoeFtZHuhMSXMvTOwZNpbeNqqiqMB41KTEY8IiknztO4QQdIEn a3bowI7D6ioXF8QK26cIulojdCDvRysRmXoBzeglmVUweEkMdBKJ0mq0/bmf+3tN nwfr4qroOr4NcfMUKIkbfMSTm2ofjDoMClfl9QxD/43slJ1WjfG57xItQGcjFI8a Q1qIizHWoUftuaYO7XJ6yC576jiASB1rS9qmdl3QB/gCi/Ti1oT5DREgtHNlc86W WehePbsGOmRkdxeZ+qIyBJMODlu6NV7HitBMPa7cR9AKl+6q9Z4ql2HZRATb3qlg LtpzkrhBvrQLpjN3ignjo8Qiri/hiJ7DskckThRKeXF9mmX0jlIBixFpMUwXcvHA viAo2r9d5KC/xs5Jm3/Qtt1+9nlps4dFYt8a4hucpn5F6atT7LobzZ6yJ+cVUb13 Z01J0k7ZstBcv6qkWyVuUbOmJ8s8tAbXPaYS1yswToh/wv0cNta2G+kk/843roC4 KSFTalwvIcDPxpt53l4y44XvdCUD79j91qR4hop0nKgo0PhsxCib/9gu2dMf190+ tCK3cTjpmCQlC0B8lICkXxQcqXg+1g== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8B88B78F402F5B52

http://decryptor.cc/8B88B78F402F5B52

Targets

    • Target

      681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191.bin.exe

    • Size

      135KB

    • MD5

      c77bd2ccabf797907546b37f1fc710b8

    • SHA1

      2185a4adb041f3207320fdf80f4125d00cd135ee

    • SHA256

      681836cd8181c784646b39238d8e4d9323b91c71690894782220e2678c1f3191

    • SHA512

      e4585de808ac7313b7751ea91b0407628d508329cc646215e5df2af967d7c0036d3c0c9c082ad590e716b0a8fe9e64a8050364db401a3453980b9fab1eb15a21

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks