General

  • Target

    lg.bin

  • Size

    290KB

  • Sample

    200730-kxkw4trasn

  • MD5

    5f58902825d15d59528f98faf43b86c3

  • SHA1

    f09e5e72b433d11a32efe2e5d63db0bc7b8def59

  • SHA256

    140f831ddd180861481c9531aa6859c56503e77d29d00439c1e71c5b93e01e1a

  • SHA512

    5aae01c51f026e7382bf20117e81cc06a975f561370e7f9170b02bc83e329cc1737d82cf721f3901cf4c2c9180423bdaf6a375a109d05e9ca164c7c08970a3c6

Malware Config

Extracted

Path

C:\m6x73942b6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension m6x73942b6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0BDB1394373EB709 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0BDB1394373EB709 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LyVhNK+dVAiLOc596CP4OUXtwbG1Ml9td3fR96ZQ/kQYCzo0DAzyr5OO4WMEN6QN ZF63ipb3Xakwc6Y19KpjvNylFrTQi7kXgcWRJjGRLDXeptD8ERuL47hi6EsTIdlM +BCR55MEXmJ1ltEsp+9yZ0YsCjg33OVEviJs2a2+eAcLLuC9E0wzUETv2AyEAOmb v8RIZrxkiA5BDSjZZ4ucJ8fXZBmhW2Y0YSW9Sk0/6/6vq8nf8IHvF71RvU90u1W+ LklmFOQ+L6s6KLow9pmzsmdH4COCLgjtJVSHI5ea4kMXMS8z2qqtVG7b+oBNm66m 4XMLPiWolVuEsbS+7FJprA+rTsy9HUpgiyoKFczfDrTgD8yUAhr6/amLuVH2/zjD +/WxpeT8W72ADiZAMCaaBa9MjMQ5B9AFgUGVNk46Wg4Ja7+VtChyYHif5mxcvT7Z rJ9wS2l+kwdxdw68r6uY1PY+eHCU6VvvalWqQ68IHgFmI6bRff1vP+4qpr1CFlUU BSr2GjaTczxwkHPYqdPFjMFXxhgzO3W8pbkUKvNb31muEOUK2ZNGb+C0vOl52m11 hlp0XDD0c5l3Hf+G5TpZZpe6OzuZTicNGS67fRC8utnoTFgcVvQepRT5eeSYAB8F zYlKh0eVun1spE4THge2ETXOlwUqsJVA1qillkMzD48K4ClOg8/rhocphdv0hST8 aq+ybWGVkIqGQZZb5ej3/tQ1UYgLV/fjYYob3DAkD+cV5CPI65aN22P+q/CO8NB1 EZo85z9iKQb/ZMRqznUWvrBxVYfdHrFSc+O2DCZcoD8taN8YD1cXXeygVzPawr1q Q+48WaufIkAsPinfnC4wzvFgDUFlrsd6XGbAe9J9irIfXcK/DerZgX5keQuAOT+P un4LnsgiLrY6qRRjTrQ5wqGa48kchbYnSn2aHM8ZBsupRQlnXok6SBXUaPczp6Rs LxHEcpwBpIT+AMGqMg7yIZyQ9UG9YyaSme1YJrnKfr0VZbQZxRTtaemMl9/TW2tE W/1TmU8Co0yi9uzwzzd47OKUHHKYTRqNAFpYEtj69D97GpQkAjo35S3sIjH+u6s3 p9sX4l9cCRGh6Ki/6GpKmDXImTnbkT/9izEjP7rBNeY8d4BLdVHs3OmQvF4GBern 1VAoE04Vr7E6PryDxkUUkXNw5pbm2WSitDUwVUXT5BhIixjER+ONf9HBplAtlc1V XHjps9iKsVZ/x5QPtbgT6NZX3acAN7SvqrZKQKDQCIHP47k+YdyON0YL6veVvXdf IY8vvg+dujaET4o5HznhMESVZHXdRtBPyHVemRsTuYXC/4ULD1niUg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0BDB1394373EB709

http://decryptor.cc/0BDB1394373EB709

Extracted

Path

C:\88fw8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 88fw8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9CAEB518F653B061 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9CAEB518F653B061 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tc4DwoJK8jsAkl61nNubdIlUhQxvcnVvRfVweDG2AOUq7F6Q0rZbJhc086h8pRAD GU/k2Q3eKhggFU9PkNWGU77rrcxK9qgOulPsI7UP/Q7kBiPlRULmEiHIYh2A0m3p bwsS0Y/go2Hj8bg21b6zIRS7bYNZb3cdqhcqf4B9etocKxM2bRR3Y4pBbA+Sz4mj oQp1fYa2HjJGM/5FyXxpGKr1LevKD+6a+gYCs8IpIIL0qlLLm2n5NL3oBPJJojek sE0kELThEBzxScVIwkYlQ9ltn0Y3KozAFxZetLS1L0cA4Vf8XCqsDKU1UMSTu78z sM/89QwShJXnY8Y1+SrU3Q/sg+yB4iDjY3teC2ugdpSyJz041aBvyhMlfQlxdSTf ywguesS5/695nin/ZJZh3jx/Jewuv7rgR0ew8PdPDuJctKRXav3xMhvbOCCTAqYT KKpS1ixwz0KZWTDjSBT2KdRR5p72/AA4MnF7Ou4oFCE7Jm3h8IlHmkl4d59TawAI O0DT6L1oMypiIdiUmNYvfldz5L5RTi1md5CkKDw1UwtDZzuEPQlRoa3KPZMSRBXN U8cpH6zLNJ2Pm3yHsOg/PpJ7aoWmCtddcjOvM5r7A5oAhkO9XzSsbrrdYrtJ5oTV /Oem34+riRHSqtHBPHdVL2rZ51Vsj5yMKuFjsA7k6vdVqi+vnI2qoJvdrChkKMQ+ byvykX7IdBskI0yr4lRc07oUBWIoRoemzo584yuT9/tFD4i9HvsznfRfS2p7Syjh SLGBOfgIx/D6mVf00gcI+BXOr41+d3/JwG5F7H2T4JvMauL7Ni+hdVNGP2iwTw2I SEJOw1btjLRyJX6aJMOLO/kUgQexj4g4qrTHV0m1Ol/9PcLsd/4CFQahG+ruAxRj QYgTTwYrofuYYxbGy5LpM93SC/yx3V3JvH1YEAVV8gTQfwIyP/MDcZXIQZJm3jdN Mslreof4463JQ6mfNV0tC2PgphsB/KXSC6fxHJcGmwZJSrlugv2GGGT6ZgsTritm mQaNYOMHzBhemnjmzDTniM7VB+3nDWZAzujlx8FNt2C6aGrDAw82T73a2VWEwEqt b5Cw6tGRK66wHJOzomTBAHH6au+gZx7LCF170eUGXZolCCi62NISqTrB9JedqKBp ISmz3xmKd+Xdps1TC8URrRg0KcU5Gzwpf5irQjdXEbinrxSdSjvrfF6CFWX7MhWb KRplOJOQdDr1YlRnS/do5yaXahf3kntKjMmRi2CdnsOSxef8TL7qjP0h29NClGTs 34ofUT/3D8Offm4C7KY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9CAEB518F653B061

http://decryptor.cc/9CAEB518F653B061

Targets

    • Target

      lg.bin

    • Size

      290KB

    • MD5

      5f58902825d15d59528f98faf43b86c3

    • SHA1

      f09e5e72b433d11a32efe2e5d63db0bc7b8def59

    • SHA256

      140f831ddd180861481c9531aa6859c56503e77d29d00439c1e71c5b93e01e1a

    • SHA512

      5aae01c51f026e7382bf20117e81cc06a975f561370e7f9170b02bc83e329cc1737d82cf721f3901cf4c2c9180423bdaf6a375a109d05e9ca164c7c08970a3c6

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks