General

  • Target

    a3cdb3929b4ad03371335e2cb854e5cfb61816821cd4fcb9807e4fac57f65ea4.bin.exe

  • Size

    116KB

  • Sample

    200820-73jnva4ens

  • MD5

    4d674a7b4159f4e319a2ce3f80d9770c

  • SHA1

    fff0667667009708ca5508c388d8c7cfc8ec7ba4

  • SHA256

    a3cdb3929b4ad03371335e2cb854e5cfb61816821cd4fcb9807e4fac57f65ea4

  • SHA512

    a21934df8b2e3b8001ef099da6c6b3517d69164367b3ca3cc04418241e962c1557c42eec53215a3d0ee27f7516fa03e05eb29a6c46e50b61fa89b2abf3b338df

Malware Config

Extracted

Family

sodinokibi

C2

carlosja.com

kisplanning.com.au

prochain-voyage.net

wari.com.pe

centromarysalud.com

icpcnj.org

ravensnesthomegoods.com

alhashem.net

joyeriaorindia.com

kaliber.co.jp

teknoz.net

123vrachi.ru

colorofhorses.com

elpa.se

noesis.tech

schutting-info.nl

blgr.be

haar-spange.com

vibehouse.rw

plastidip.com.ar

Attributes
  • net

    false

  • pid

    $2a$10$8pGkqkwpf5ozw33i92szM.LZ.lXV4f1xIk//mDZJ4p78LRryzLG5i

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5135

Extracted

Path

C:\clqbo2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension clqbo2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2151D18532CEEB8A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2151D18532CEEB8A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 03cCyNawIfvc66zVgxIREFLtxx4rkHjxYZGJeFf2DIgPzWeYgLuZ7P2DjDQKZZ7Z qHpmg5d4nXfFleYW+T7j355IWcz0WjBpbPVpN6CdBXuH86+Pg+dBZBYr8vOf1E9M KJwTgAZqz9KqbKa8B93uaAiEMpWClUy/6E2P/vP+03ecvQuiFvWSl92WMW0RFTIS bzP17QtUyV2asQYE34wdchxNfmP8QdpOQYQAATSYsf9HQ056nywEYDcotT96pSGZ BROzDpJ+/8lKqK+zpBWDbxLQteB8qlBJ4KJ+gcUWeWaEJAznMy1e327d1p8khfhu r1st6uAw2Icpf2XZ7tyIXrSAPxD/Y+gl/xx80S/ycKsQ/OLFZ+zPrBzDy3w4unNP 4WmqyWFIqexF1f5AW+Al/MiEegs/5vwYEe07C1C7uHc0TO+QAyCCEEGpJkBa9nsj /btelxUJDi9NOwYakj524Q0vDCJ2182doDSaJl3ovwJD2pZIAePueqwPgUOOwLNi kzed6GV7AeH01+oy6NzOVnMGr/X3NGtW6BBG6psjVtd9QaEodPy//zwt14mWqPol vE9ROOzr2s7GI86Ra1veHUJtCOTlpVuxbzcOPS1hqYgjZ+yWqlvdxyFsJO9zHPhR 66tb01qFSIuHYmXCl1znc6H5ATesZPGlqJnDpZqi0eglhi9XaAkZKsm0vawDi+Fw U66EyqZC5V7UZjQ8w1FBVxaehfb3cDDlzom52NRXTr4ZdRW19ah3PaCNWxOXKSuH ZnEMVloT8VSFt/v5JngOgbiloE0E0TfEE0XQk1pH9XcqWvmR51pti3Wo6c/HolOf SPnkg1CET9AT5DbITYwL0iCEqF7CDacX2j6XicveB8ZTenEEVflf2t4QN2L451Qf /292p6tgZWD4YQI4nxZ4Eak5sxNfp2U6CrhUXiV2VhFOTXW3PHb2AjWat+CAmKEd FiuXz5ALPXyDXPan/1z2/6OieA9Jmuny3QT1dNGBiYy99wUPHHBiZcozuXnNCNBo SrTRby/e6XgGdnHqkxdc/DcVA4cbOdPV5KrENYteo2B5tP/HMNdtlXDvoDjdZwR5 JR8mXNJ08me7j9rWKI/gQC6LGieZpnN8LlghtgdkTsBZX5xB5Teb6fa9WT5Q9ONS utmyPz7LFD3pG6VDfzeKq0GaJWwZWCDYl8kS356mQDiiRg+tKZAoKWBy4M8x6CrD 6YEivj2ohlZTRvgz7I6T/fRLzAUVEN8EaIMzN6O585awvHyVGp3A5GblnMYVwRfi UV/DgyZa10JgSApkhPAvrw/LcKfoKpE6ROnb4pb7foI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2151D18532CEEB8A

http://decryptor.cc/2151D18532CEEB8A

Extracted

Path

C:\z7l62vk6fx-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension z7l62vk6fx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ED9AFE1FEE64A01E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/ED9AFE1FEE64A01E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: c1tRvv2CunhgFDc9uR0DPI2i/+jj9VQzsiik/BWeX8ms4E01TM72jDqYHnFAq31s 5b5Pn52tObs3eOk/DR3qQp4DLJ009G/fPurEOHc68+u2m9Gw1OtCu1owmaokrQ7l yDac86JyCNvBcFZjY9MWzCj2WM3s38GBCyq9wvL6UMm4td1YXoowKVmFtynzPKeL oM1H7kQumABzFX7QU4rBDI1hXQlWu6G8BWWpytx0ema7pTMQI7+6fFqAKI40wvOs 4BvNXFnHFubEPyLo2xzCOBpP3afQ61tX1Z2KzJSXAML0hkPGdPq4z+S5NkawjWU0 9x1Yc9cr71Z8U8sWy9ylMZJYF9i1DDjXJqmUH5wQt5RsS7bkAoBa6WFpbNBEgw52 S3lWPUvqfKkjK97zEaF0NZiekSmmBk1T2PES48ndYxDufWxuX4jmLB6f0MCttHA/ 3kftJFUW3ZkbyO1/cbF9q5Qj60t+GWWy4iLBcPNsh6pV6UO5rIirGHkINTypgoGP T4H6LnXW4bSqOZfZCpyxx3vbjCvwYe2J7B6UZuO3yT0RxpVKQyrpE13HrtvkYZIG yvyk8P8YVHQn91E359+UFFM7RU67CpJGdfmvN94kMmAEuzvC7FfeSOaL0TMmLOWU 4vFu3p9Jbg7qGOuOxaOSkWb22WbdeH9uF9SnBt7H7G93RiJ/am8airGLoE/OyY1N RPPNCTKyg9HIMtZtyptPvIBb9KMvzOhz1BYfDMHL/EOVsIfbJenCURnU+odq75Ts BOpSsN85+u5F5c0up7XtZU/PkeYVUGx8IgHIfKmSPOTcF0U6/8sxjO9ajXoCDt3R 7/f2YRR5ZvZIB23DvjIp+Kfm4Lgwq9au5oJSeHILzpRjMuhUa1kFUt86JLhJrFcT E8w4TiRhkhWVZzutFPTIxa8BR9ugwmf78+guRde6il625V0dkB9rQLGh+MhkmONh GhbYTMpDfHanoWsCA05srokbUcMlgoEJO1fbyGBGQVFSxN34A/kW1doDjQxCn4Ub hQSK74jxyqE+alTKizBa/UIRK6jNDo5y6lZHppwxuFSwFaSu+1CZyq8gexYjXH+c C6H6emtCJhq5zhutihVUzRoJU3MFir0rO7J+TCQV8Emzr7OL267KOd66sUDP8qRQ R6Y+StCn2l60GdsMP1nqvg4kj0epZkF4E9so2vkQ9Wi4B0VBeRzO5Z6FFoPGi3h0 EYm4KuVEtfeUmjwr1KmRqrR6dZISxirC5fZUu7Ft55P/I8pDYofvUjyRlGId6fYU 32OZcl5UJMYMez4AmIaZrczz+XffsYJ7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ED9AFE1FEE64A01E

http://decryptor.cc/ED9AFE1FEE64A01E

Targets

    • Target

      a3cdb3929b4ad03371335e2cb854e5cfb61816821cd4fcb9807e4fac57f65ea4.bin.exe

    • Size

      116KB

    • MD5

      4d674a7b4159f4e319a2ce3f80d9770c

    • SHA1

      fff0667667009708ca5508c388d8c7cfc8ec7ba4

    • SHA256

      a3cdb3929b4ad03371335e2cb854e5cfb61816821cd4fcb9807e4fac57f65ea4

    • SHA512

      a21934df8b2e3b8001ef099da6c6b3517d69164367b3ca3cc04418241e962c1557c42eec53215a3d0ee27f7516fa03e05eb29a6c46e50b61fa89b2abf3b338df

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks