General

  • Target

    e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.bin.exe

  • Size

    115KB

  • Sample

    200729-qr56ab3gr6

  • MD5

    0800618cde0d124c6616ef384fbe1434

  • SHA1

    9404f15917b9a216242063d1b7759d891bf11314

  • SHA256

    e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923

  • SHA512

    0dbedc86f146716a394af812e63e6b721c37cf1f49da07ac35d2106495b19a5f473344ab90a026e84441c4d0741c3b21ba1815616886ce692d6b6f03b0a45703

Malware Config

Extracted

Family

sodinokibi

C2

arteservicefabbro.com

lichencafe.com

nokesvilledentistry.com

fatfreezingmachines.com

iphoneszervizbudapest.hu

kmbshipping.co.uk

readberserk.com

blog.solutionsarchitect.guru

knowledgemuseumbd.com

vancouver-print.ca

ctrler.cn

sarbatkhalsafoundation.org

myhealth.net.au

aodaichandung.com

easytrans.com.au

hvccfloorcare.com

filmstreamingvfcomplet.be

myhostcloud.com

morawe-krueger.de

noskierrenteria.com

Attributes
  • net

    false

  • pid

    $2a$10$4ijuoKXzZS84.hB0I8Zd/uonfprFslHO.9PY/zlYKxjCkXRlyDZNu

  • ransom_oneliner

    All of your files are encrypted! Find how to decrypt {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3476

Extracted

Path

C:\How to decrypt z3c9c9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension z3c9c9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/98ACA45B380E2D17 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/98ACA45B380E2D17 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 14FUKb3PxkYzG5tN453dd+KYbJY5kRnLiibb19PZEiLERsy2bFiCpfONXAS0nV5+ N7A/ToTV16Kg2j6cGo0sWoWhff8RP0OzjYLqZ/P2BABONyeDSEOKKIUxqsCswiNq 1pRKBk30e9RiLiPNIXJlP7wjZcJDYPOQyFBcLyAkSdPweOfVnsJYgZl4kiaZ4Jfy paF8mzl61ASCB3Q4JUuJl0JWFzOgXItcmvWekOkl+mBM2IBn2E+k9R6QlBRadVaF nvLS+IL+ECFjVKaQOe+p5hiahJFaaU4z+xudv9MFx8yCID//zdBPYfQ6GcoWIi3l /3SEJCuS5ooef9KMkP+Tr4+AfgXhCmSbdHB5PwsCYAF44tUZDK/9UkFW4XEIZQ+I r9ZEb5YVAAMqwonaVCB5Xkphqfv65O/KWMsuQD8Re533GyOFRBh/a70IIDx8iHbX a15xRdxz/rjrR2F0H+ZgqSnhy9+q0GnGx9XwI83zmyFDHTb/y4+T6zAOGbpziLEx o7ao4dPf7U1GqH9B+UKWlQssUJiWsqNT5yZyPAiT4ITOuzX79dgOR74NHbVh8Q3B 4M4pVouSD6O3jG/V9GY3lKRX+QP28yANooZZ8rKnH/oefwuB9160xOL3Q2pCbHfg RBGR3Fh/R5c2/Lz/6+hB8t/o7EZrJb4j8rGQ2UEr/QcaBWQTKhx4jz7TpR8vSOfZ LmltCrqWDNx+wKJepdvoteLW7+D7mbaHxbYFvvqj9dlWED3ZHoiufDimvYcXiIRn 8WMGiyLrh2RXzZx6mWYXdV+5RzsweCpeuLt5wOKgNTymW52IGJCUXKXhH3Ywl8bS 9NmkM1GNjWv9I1HZDyYBy/W6rWSyMEcHxwAq1xY4hxRIHMUvmAgLzR6WXBpZRVct yYxGXXEFOBDvpzS75T2rbSJDK8T7hJwofZlZqeTPX7Gp/cmisY7tPjwAWLNOFA+8 ZCPEywnpAaIjdw1fw7u02++INlJTlMw9b103oHxVuAE+qu+6jBYmHGaztgo9kwaa mUwJANVoJLOjk78YKxT9w83Z4JkxnNCrmBx8xKnLhVv+ty6AWs5e+tgCZu2kqk39 ETfnIdGHFrOvf+B94V5JuO9VqSGCNy3mo+yaXvzgYXMs5h8qFvpAA9yBIAw6zilL NtWpRtD0Eu9GTUzBaarGZeXVa7ARtqwwV7x09F67QrcTjeuYlSICh5qZItz/O/gM gIUQ0deWrQLaBojSp7on8u6GzwX1fREB+l7dDbOqiGodgy7IK+GV58Ss2Za16CjR 6qZmKj7UYRB+jC51RrdulWuZNa4JMSbXjv0MEPGimrA= Extension name: z3c9c9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/98ACA45B380E2D17

http://decryptor.cc/98ACA45B380E2D17

Extracted

Path

C:\How to decrypt uf1a74-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension uf1a74. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C10691F7C3AA2D8D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C10691F7C3AA2D8D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +ibhL+bYeK8DdU2NHtPcUGjfvB1P8ullYkoTZEBP1lC0WI/gPnLxkhP5p1bvwKVc Ir+d07CJdBJ0mnSgcSk96LVixOnJruKJ769zi8jNRRQi6ldJBcOrG1A83Nis2nmS qY9UVewnEJJVo+1F21Uyfi3sEnvQwcBT065PX05C7wMUb81MH26kSFB6Gl7T1sVu zz1XPC7NX3tskrcz/TtYUyCzifQoTnpP/qpN6UEmkbfHyN/5GXDJ/uXh+tb/3g56 6lnFbglpAsuO/BXacBSnUC2WOmjxh5PRopPwlNsoVL3JWvWxRlPolmfdLBHTvQot MgvcoLzyxSuf93QDRYAVwWnIHxVKR5v0QHZXoEaflr4AalZx3Deb9Ljd4XVHdATN NxTmRgDi8R1R2S+iI0lauCqqR4vR5NuKkaFwOJHeDYx+nE4jmN9Bcn90RxDnEokD +j2kz5At7dzOwiN25f0C/MqTkCRFYakQBIsCTmz1T4swLf125t0GdDAYqUl5tWPe hXM88f27cEySp1pXkS6FO/yFIK03zwwK+xDdKCBmrHqUBucs09e1p32O5k2suIdJ OfMBApGN5RqgIYCJK8EpSJsupmDp0CYR/DLF3AQDjAqeAyLJPbihvTKf8c87xl4Q fvdQe15+k67ChqhBNnktGoC0QLJ/ycVCECA74tajEIN4ADnj6ErMJgr3mjRW8Zmo L9/blYtDe4rJNOatSGwM5SiSTl4M0uYhrJOjQ3zUafimzeCrpTEAWD+dEb5cTv0t w63SByLjjqdN/UJ2K6r5TIllUXJg0hJirStB/oLLHlWLXqwJyKbGi0ixzyFV9ujh 7AlT+vpm+zued8RyEQjZ8O6pUtYPz3R+J4NFlxJnEzJESDkckrPdmrETxhId+wdO nmwMhzgPsLC3zNeOFmkINjH+cDD/WSQJ8THLHURfyjvHO43aQp1tjVnKN5eP8JXm m2CPTQE+3jjD4/UpkjRQZC1uO+9U/Hv66HI8aI/yd8QD1Rpv7At/OXVmEkhGLvBJ MIYyQiElfi+bhduhXzEcfovd0zSa8EDQj+qFWYD1frgwCVRG4/82zh1TNucgXFr/ 9eK0lOKAHQZjzGaupO6Ka4U4zkvtQ6VXIJSPfbqCVg1i4c+3DnflhG1ammQLrUm0 aD03JB7G7t/HJGuAUqUw9SM3HGs1ULfHkwo068tJZ70lLLaw33pJHUtn9BfXq2w7 uvPAPtXHhC4XgtZMTW5fU8A6TG6Wrf67k0zWCVksRCswdpx1nOUUimJeDDEWnCTs kWlL6dvU9/F/5kJ9f38TFA== Extension name: uf1a74 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C10691F7C3AA2D8D

http://decryptor.cc/C10691F7C3AA2D8D

Targets

    • Target

      e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923.bin.exe

    • Size

      115KB

    • MD5

      0800618cde0d124c6616ef384fbe1434

    • SHA1

      9404f15917b9a216242063d1b7759d891bf11314

    • SHA256

      e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923

    • SHA512

      0dbedc86f146716a394af812e63e6b721c37cf1f49da07ac35d2106495b19a5f473344ab90a026e84441c4d0741c3b21ba1815616886ce692d6b6f03b0a45703

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks