General

  • Target

    YBAHw19X.exe

  • Size

    116KB

  • Sample

    200818-mn9jcewvkn

  • MD5

    c6dcff3157df6baed69092a977d0ec63

  • SHA1

    5114221dd8e4e0b50f04b92e0ec2be442ba5e0e1

  • SHA256

    9fb4aca06e67c01e6ae8c11817428cfb8e9206d9bf2fe1126af8bfef3d16835f

  • SHA512

    65d54a46d3acfc460e9a5a4978457066016e8c0643643eab3038c74be2fe623c019aa10db67f0e79a6a339b27d377bebc8bf8c90bdb29fe41d69942b8410f338

Malware Config

Extracted

Family

sodinokibi

C2

mountsoul.de

socstrp.org

kedak.de

sexandfessenjoon.wordpress.com

blgr.be

employeesurveys.com

huissier-creteil.com

geoffreymeuli.com

dlc.berlin

philippedebroca.com

hushavefritid.dk

crosspointefellowship.church

finediningweek.pl

atalent.fi

behavioralmedicinespecialists.com

autofolierung-lu.de

fannmedias.com

space.ua

wmiadmin.com

degroenetunnel.com

Attributes
  • net

    false

  • pid

    $2a$10$TJKrOPJ0eGvQsmVbsaPqJ.QqULxt7eg.Hr9mPfVBZgWmdqGbgXfrS

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5216

Extracted

Path

C:\0pgg2p-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0pgg2p. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1A17A93B8B86C2C3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1A17A93B8B86C2C3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: nWJPeZDhmMAEeTH4TW3Jsl0+4i1Z/VPRxebg3FQAp5ozR698xoFovEj0/QsN3L/R sn1uJAGzhoyZgztq+y7EDuAZCqbM/wbIoz5Xet/26W4cHBrfGTBP3vY4WfUvBdpQ L7/ucIDtyGUbkgcjcDFvvQSx7BfM8XRfm6DPYslSSzFDMmi6nCYNmUBjdP8EjlVk MUejHPj/oYK+cd3YvEETNRC+zP990EUgGgaHRBevN6EK/9w1zGhddxKAn2+wnLZd TTqiyqiAVGTVfacIMTK6c+MboGoozxEgeoeImHJ6R5LnJCNlJ4wTbdJ+xP8SCcV1 eQhmw8vB2MxZh5rQrxdBdTFu5gK7KP026MUwBC31++kI1hVPg9DaXPqAEfEcTgCk +CVPr2Hczw/DZ6Jtql9alMSG0ZUlxblaqc7BeFVGAmmno9/5XtAJW7l5hgs95ZMe k863TNjipJ0c4go9+rpZRNj0tWApwJW1mvMrVeQX07vtS/bn0fOW2y324dwcIz6P dVCwRc/ZNK3+X0u/GuiBr402hdNHcsqwC0SFNTHWWKK1DG4zpvhuAkCxeGDz1V2A tiBYp8EiSW/h4MRaDTU7eT3wglAnsg8j7sZfGcRFM/30EfUmHe4XMn2KATEcf/Di E1GVG4uwR/Y67GrCbJVXoS+qrHQAGTQnZTmNCbZm24KwoQ4mMR+7FdHKrkcGhc9v fYwwzVWKcp3BlSLTS8tmdI6kMoKcf4naVegFAUS70m8kXXZnj/SirFLCUuN0tDE0 2mGiQ6A3X2qriXTBti3pU7GOa7G72uFfAvVslhNI4P02NOkM16w2PRKaBvvcHisM QX+rGNXZ8D4LLP9by5PJaeOlbIvwG0ZAy8uYHypIvV3R6/GyUz7Ak0IhrFdpC3QJ UuhiwrbPpXgVt6mHGrRBVo6OSFX7asIuPy/NKk02uZ7MZbqG6aIMuWDl23FbNb0i r2Ms0WTctJJgYDKxJWrBavgdgKxuCjfdgNmS6HncNua3IJmRfvWRQit06HGMK86X 4a4CMhjbTF/tXyLa6Wa3vebRioNZvx28kO5KwCZz2Fhraljxbd+UXZU3+Pr56bWJ 5uNcPbjg9cQrvehJRyTuzm4I+YDAxHroZCcwZlFjSxa3cLc9+XXP2p5+/1uZCOIU /+DhIebDcfiWGiIOQ7elWw2lTz+Yu3jeZPEdMNILd13uDB/o2oSE7vsUudXHUSGG ls/MBWZ31frAo995/fF3+QeU8M050rJPnC+Dr+AD/NLbqei3lmYmhBVvDBvvEkZ/ NDNTOBNN4gqrci8W6ppObgcGCmYJsF40WtXH/ZW7EoQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1A17A93B8B86C2C3

http://decryptor.cc/1A17A93B8B86C2C3

Extracted

Path

C:\jqi739152-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension jqi739152. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/810361ACE3B05675 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/810361ACE3B05675 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yWm4s6ZqTJMvQLFKcW0Xzr0g9vi8co1bxymiOXlqp92h3yINLzrtjeMzfHNk2R7I WbiMMJarFX3bCUrZFxpekU3CmbZHEtk85yQMGMthFIoOUiJiq2NPvKs9DbcgrQ/s AKJ+8r9AX/5mrLI3z71vyjc1ZnJDXOsSEr9KhUNO8OHQaxagbLP2JS6EsA3IXbpw HW8LJ06qKmirlzbfSOdmmndQk72G5nIeOZl4VidQ8GmIil8KqHuvdettfAjQ598/ +XxVb6fr/GBDMQzs61Fmu6G49BijKCE++dJfYkuKID4Vrx0Z88p4uFmgHaLSidrh /Ssl+DqhNSvQjcJ95cukJv4QNB/iLXsn0XfEzF4LiGLA7elaeyPH9SjgKm416Ozt PyLogK8m+eSqMEZ1P2S9aiJZtuSWJxKDw0TZvdpKO4z1C+gp/W8Ko5Vj7J+TPHKI qZ/3np7ezVDRgku9XMyWUQmRok/3T299U0iSLLG3TfcAlDIInDRAjL6xEpDy1Z17 ZRYLLXFRgUehECEOcfsreUXURzufgAMx+li+eZOHxhGpATS01r9fK50IZrNCBGr/ Y5uazQ3/y4chFwQOB9JYW69Jx+vF78JevCoJSQcxHzg7rG4/XjN/aCD0BDKceBao Q+vWruF7C1qqalTupTdVH8cxlLCwxSgmToIzqoBZMaVG3S5B4H7/P6bb31F5YMUJ BI2whQScTzN6rz2t5FZ35pOQNmMBdf09H5lN9kqvBSX3maRssjrP3UiBaaFhCDPh Z5ynCg77q3qI/UncRR0e9Wflr1N51Lrs/SmirKzc9Qp9cnN7okk0yLoM6c3hzRQT T1Kb3R0H1sGORo8VkiXEE5F4L+gDF4Nv0Hf6UCebd9aAvTgZ+u7Wqj/UiHG9asA1 SZ9tC4O/rn68gXxcQJI5WfRMz+96CZfuRAvisqRo+45p7VqkHspVMUVQnvR//yRE FSlTY5LFF0VS+kh0zLZK/N61Qm5VbyEtq8CtPiGOGDUBc1DOQVOJ8f4AjP5fKmY/ w0VwncZI2gRc2ksNcAQ/m+xGzpaxXQpFmaqJjTUXpRg3JoU3qAjqSlEJsDgL4DqW +y/Ct+kfLOp/oof6+uPlpcLuCxbDsbc++DI6tGFPcSxbcW62xE9fQs8GG74/Occ3 KOqStvxZrhfHVdzfTKtNK4V/i3+EdLFtbAx2uHuGem7Pzh+Kw0JmcATQoPJAyjsO 2eHuw6+0WXgoHpW+aC5t2J+dfTqvK53gGzoxb5+HszfcIZr9gwnfKdMBUb6cDbMt sRi07k6uBYhNM71/mEZ1h5sZWQOQcA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/810361ACE3B05675

http://decryptor.cc/810361ACE3B05675

Targets

    • Target

      YBAHw19X.exe

    • Size

      116KB

    • MD5

      c6dcff3157df6baed69092a977d0ec63

    • SHA1

      5114221dd8e4e0b50f04b92e0ec2be442ba5e0e1

    • SHA256

      9fb4aca06e67c01e6ae8c11817428cfb8e9206d9bf2fe1126af8bfef3d16835f

    • SHA512

      65d54a46d3acfc460e9a5a4978457066016e8c0643643eab3038c74be2fe623c019aa10db67f0e79a6a339b27d377bebc8bf8c90bdb29fe41d69942b8410f338

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks