General

  • Target

    ransomware

  • Size

    116KB

  • Sample

    200803-4yd2wdd3yx

  • MD5

    b86ad4241b01376b3924a380f6f4c934

  • SHA1

    10682d08a18715a79ee23b58fdb6ee44c4e28c61

  • SHA256

    14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

  • SHA512

    54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

Malware Config

Extracted

Path

C:\2d177g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2d177g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7084D32C9ADE1A6C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7084D32C9ADE1A6C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GWgiqPDydwx0byXHEM/EfsOLIP8Uvp3a1ccWVpURGW+FKW2yLmG6jrdow0XYddkB 4ygwfNbmustKKxdoWOZDioJ0BGTBxvsbW7JkcnF/SWXtjVXTPeduEUOBshi9fuIr E08658RUXliV2dtcI3kGTgsjCuIVhIy5CxGXFKL49MwWt3m51HCqfAwU38B2/DUE yDN6Ww+asX7d84srD8tRr+KteFYEg/761z8W7jxT5mvBvF989d+oCYJ3NErkLSqX gLPHEE7OzGN56DfpMhWMdsJ7BjwPB7+wCSnACEWbF5twjIJfleUeE7HlvGfR4GVw UNSiNzQ1YshWLoFPHJqH53nChbQYTfouz55CsIwM1icSInM11HgSgtw+vGtsapsG T3tmwBerXLphFc0SbCXOxD/zAK10cjx3FUlJ/TZVYapwHM+GNmj65G/OrUCrtB0i dZwePyPDjShEV6rN19qdzhWvTe2wBZFPfONcrA12f/xqdR+O6H2CuMwvEJRhIcsW 9fOXOTm+N1k64a0Ibki53BprWXRU4bHDGBAQLvsWNGnjwI5scMRrbqiILMdKHnCs ktoXtgtDPDC/WXGfLaAgAF0lnVmRQMVHL+G6iWNjBg08st/qC7snLEoGjkCjzv7l YI2XX5ujbkuCnhZrmmMBLxZcRsHLsGYHXXE9cmFzbY9TnAsksqqzmFHCj5yMyGA2 iTpl7O4MB2dbvVNqflk3KNvnS/8QZBL6z5/vWHJc6F78MvXdF+tQtaeKOw60cX/P cSI89ZBdlFQiZ5YE51Op1ovg2XxI7D/C5xTYQmDqT4NFFfDPZc456hq+a7xRzwoS x95GgqiOwp2ivqLm/EBWhMHWgTPqnafMVHkXCGpNjbYQuS1cYmzaaQyG+VIP973J pSwsSKCZXa1ow94h1jkBbaHOeKhXLom089N8eWPtLOh4QXPHutZoQMqk0wu/OASt YFDIb9CNUCTYkkEy0RkLLKc38E6loVSvKrKm4Y9Zutvjg5OEYFGB/97VVl9qmU+p v1p7bLHHV2R65SsN8kuxd1qZ4MFq7CStBclCu7CxYRWtc11sb9r6zdubE3AqdMCv 3yrKrJkq9V9EAvLDKGfogqk+Vtpe9GcUozwZNcysqlJBF8ouU0HcmItOvbAzYAck 88fBAK1K4SY3LAIWMNHMynfH/kAVnjtfwNo2wteQUMTKyOYCixuQ8RQVlw3Q104r mgznELn5efo8yhY0PkbB0SuY+6cLeB/JAuibWhs6v506DMVA9ZoI93f7Ur3ZnyVI 2nrvl/GuYgIrYSlR1MlglCtcSray4K2Au3xCYGdf4ZQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7084D32C9ADE1A6C

http://decryptor.cc/7084D32C9ADE1A6C

Extracted

Path

C:\7b65d-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7b65d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/335E1A9A78A6847A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/335E1A9A78A6847A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: RfPBWX7xyhrmIssaOD4pWOGpg9PiYajwRoQ08uHGBf+o5uAzZIp0vmEnZf3kQyop 0kcdBxUFkEaAm6eye0+PI8pp/WZnygvFwTyzBpRQjgdUfrgs2FPFlbNh/4xNubXD dlE9g75u6qDKDpP+fF4eljueK2gcPa//FmWXDBqWZpZ5N76JM1ZjW9LCdzGgfKAt 4MiOCCg6djVO7npyv28EetDPQ8iDx76jlMvyipYeb4qaT31/A6qsn2qH2zhtUp3M wNyvIkJ3zrk69FX6revo3L+1cGkWdtXsVyLHfMNeYE/J6zhD+EESRQF3hk4Y1GEA cCh4mXs4bd027hh5dXuJ6T/wgKcHPNpTak5pa8ViZC4ZVwu5x/3NUv6epjo61oxn QiRMGovf8yQ3OJDDlqyAFIUwVHgP1ZUu9ez/MdX+k2tJVg3PQwApP5CT9r1MQDcv HI4qCLHpw5otXqf5qPfA+cQxNzr99PX3oxY4POe1ZT26JyliUWQuI6jdEREiQUNw oMy8vwzqht6nj8x8kJlHNUbrl8/NrHy94N+9vrHyzlRyk+LudOXOk6YMz6NvdqTQ zfSwFde3eE3jLOGPHeabEFri9AohS2KHMlsuHDWBma5gkxaJZ006t/V/g2O9Q97r wyAXnWOicjdHimrdcLpMoyHFx2TEz1K5cWq1K24KRPN7Maajcv83dzm8Kz/bGFIH Ra1LYnSPdOIe/NY9AywAt+7V8LQG4zUyxa2ktcd+KyWMdK0x8iXN5MR1E2Qjmlu1 fuwnVuVwRsLN9akIEoZNp/guMtuFY0TesRDpgqcyH3Xh1CGf/VYD7aAxuWPC2UA5 rZODXp7sfv9AtzsCVC6MlUUOLviOmzYb6dl0VLQGfA0jTL5laj8PEpJOcjGIaR5D LKSlgXNajvmVAs8yXr3enc0IVfRDpbrmdDxqiE3ARB0MQmmjDLLDNn5jpVmmWzkI zn6h5QBbpPmvs4io368isqQRriXAbqOVVdYd8hKXiEXvlQB4mSH7UK+JDRftkhIZ aDH56PkyML8xYdVkO/kUq7F5JftIsDpFNB7j0+NIxmliMZJlHdC0kQCAiEekJyFL W/Ju2aWz9vfYOALQnDvcm8z7jAYvPyMyz+uf9UMPBdBxBNWvwdrsGm3rWz2QqNl+ b9jdRyx1gpONbTZy8z9TL3uz19rXal1H7FlY5F0wEH99n5JO/hv52PNCavpSo7/X CPC0QMJKgngkvZ/1pFgrFrO8gZU0A+nZEd9VfU+5+EZTNJMd3lpvDYVCyRJP+iwA 7Lz/ON3xyRJfMfThs+s= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/335E1A9A78A6847A

http://decryptor.cc/335E1A9A78A6847A

Targets

    • Target

      ransomware

    • Size

      116KB

    • MD5

      b86ad4241b01376b3924a380f6f4c934

    • SHA1

      10682d08a18715a79ee23b58fdb6ee44c4e28c61

    • SHA256

      14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

    • SHA512

      54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks