General

  • Target

    4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695.bin.exe

  • Size

    115KB

  • Sample

    200820-8347m8peq2

  • MD5

    be926a24f4118fc23f09ce4ecd9ebff0

  • SHA1

    4d6b8d954af01ff556aecb055f1965063ec3471e

  • SHA256

    4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695

  • SHA512

    278b8c39930f5cd98660b2f770452f227947800baaa07a8f583d26d67bd420e3a09f44f9c625068e18988d50318c0d5ed97dc0600b5e60ad803a222dab969ca7

Malware Config

Extracted

Path

C:\h0qy8hq-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion h0qy8hq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/51BF6F9E4FD08A9A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/51BF6F9E4FD08A9A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: t1t2ZgbtsL5HIaXiKnXeH8I/mqVHW6UyjLIftxSW2aF3RdDaL5zePgAEBhepmyzo Vu7ENN46PCS1FV6FwtU5Z35/quZ5x+lBf4ZcOjc6qCxcGNrqXoWViEK4gRPTv7PC uctLdRWvriWfrIrP7yvjum79BfjMo8qSmGQGd15B5QOGiZtVOgwuiQOcR/AHcUig O9du4YcfzN+eSSnfkbsYoRXIidnRiby4av/g+x00BW5yDEUmiun4OYCcnLF8M28S ij/mUWhsC5iqU5lZWKGfASrxJQhKBxW3RnorlZEP8jjUsVRMU0ubnCuS5JrZfIaH vGEUmMqm9M3uATPwdOVYr890Jo0z5FvqtpjumVmzwY1k8lQRA5/4iEVT5nM/2LFI cuCVrDMwJYS5DpHKSIR+lhYaa5/2OmNucruHxa2Iqwl9T2RMtxaG5Z9ONdrcQt3A YpoikMFX+P2ip+e0UFz4hFc+DGIUlD3MhLdbGT5jIwH24U4SCCc9Bz1txrvemryl XqbPL0zHQEUPp8daH69X5KI+l4Yr84eAySSpN/6FppcApVQALNR7Ilp2QLS7ZKvG qtfsZxDAr6l12QqkdDOdp9D+H4CkD98H0w59Vll4ek7f5m7xQLXqDSvgIdO5dUUI UvAnRRKKL5H8giiHJZMAUHf8Q5TU6SdnxYYgexCzJf9J/h7N9LY/RAqQk7Jh/4ic L6Z99ME/myVj+Oek5tmM+QjFMf3q2RqBkrFJVvm0K89nGCAc3h0sHewbdPF4lnRS pKz73hzeSwEku3JqDnxilSt3rRWGHnF/e5Av0znbB2IGiWE3d3DVW83RKkRhyQRs QPAGT4ei+1kW0cs4WN9gg/cM+KM/ITlCoHjUzsQRsNph5rCwq+csh+7v2tFQwuFP /Gb2y4uWuMWPER5DJ1npc4tVFvHolK8HvP9kDUcP85UP9MmEHtfPCIS9oUK7IOgA 6BEpOqhYIqHoANfWhrlfGc8mfp5inwt/TftHAykw5bDPmDSDq/6oN254yByFp5y7 BsoRyCiqW53SycTY/d6dP8k5tv9RChHEgEBUQxkA4DAQkiWalVsPLpJmTiJQt+XU 4JHvdlcPNEQ0FCgjEED7t8zzaslw0q9jMuXLigB10NVjRk8HRXDqKqyepOr3vZDC uoZ6dJHU3ZAhPMydyTD1SKL0faSBnqyfNOUWB+qp+eg2d3xjT3ZNbCzChlbhKYKV Y5Y0VmZ06pmJ1KLN+6D11YOVdcvwXkO05Iak+4YpdlG9sN3kec7udP9BuAxZ0M+v bZDWGofH/Us8IDm9Nb0sr2CCiRBYnMzwgN+ZvNg6 Extension name: h0qy8hq ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/51BF6F9E4FD08A9A

http://decryptor.cc/51BF6F9E4FD08A9A

Extracted

Path

C:\n48e3981gh-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion n48e3981gh. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9DA0EA57E115466 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C9DA0EA57E115466 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ReI3dJ/Z9zgjWCBdPQolKLi/ToHa0JMea0ZLvDdl6yPWH3wQK9gNkOTvu8yJd8fg rEvys6cMneKUDi2bomiTTiYP9NKDZxFUg/Bh05RaPzVh1ISz3+BDRh+m6kEBvsGJ bquiJYXpoUGbPVJZepJNPmdb2FkFndG5he9oPjGjwqr7L26SprOzaGGPxv8jIciO M+XD6urhXtfBf0jk4qUBQoDVLKUbn5LIRf1LAP0pefWhGNZqk9WNtbJ894VIs72R 0DqfPuUXrZZeNT1zfk2VIhywWW7z+mSdZrQAZHwJPhRdQWht6zcpRCP/ckFc84D1 UNF41ho0sAxcYHZQ2jnsIVEx7M08z8fj0evEZE49F4PNMSyjjYKQiEgaEZcZXvs+ xYBrGUEs5EdODQr5fSiaXxpYxMqUMkWY/b991t6dP2MgRdi1fga+JOeyojx8J7KV vHeqtU1HckCexReLicMWknmYahQUiL7JsWe2WgFAcWcVOMEdyIGjzKsB+3eJzKBI Rc49NfbE7rreB608SR9xXSO5kH58mfovLbvTX8lxO6TXikVIhHzqaLfSLTnVi54Y TPv0HddmKKbPVLDbR6EmSTUfefgftaN0TL3ooaW1QHEe886k3QMGuEFfkMt5LWhC uuqWe5kNZ4nXq2XhaAJ4a4aVobowHezJlpLF/2k7E9pG/pp3G/5qWKMofjQEC2Fi jxYiyMD85XHVLYqUDrDOjedf2pzVAvaM/WUa3l6vVO9cAC0OGPzyh4jaFltUxdFO dTlfKD2MCSR0G3pkIe6dBJ5a7yz43y/UVL8PeFAdNq9CrMg4It97r9dKT44W5mjj 8FB0uq+tV0zVRjtYcluHWhEOZXxr2ooviMG0vSs0yTeApltyWbBitqVDb7bt51xD 1TwjDFHPX4dgXRuDmVYUMTRDEizhqfn9w1IWXdoMNH5cBluxUH/Sfsy9DU9qedwn 99cXtuQX3vss0AjyO1ZZ076o/bRFmvZcP6KDTzTsD0MW0h0/LbTVqQC/nIfq8wGJ VVCP19drZESPN36HBVoa/ZBLlDOmaIxygQdN/62Ur0PDO44F+vDejqbGRe8B2OiR 88tFP5gKEEoEkCnICQklAEO2vVEMgM7AABu1BnAAxdfm25Fp6zOOME8ze1KtB2yj zIXsp4Qr6SRz764YJKStIZxEaHA621q4JRbxaNhAGXTkFVKLvHIWTHqE4ECNm5Jr rB9MeHKWfIHr6PJ00Cgg1SDU2OQHRxdjIiRFc/+O6+rA/q+yZ+1L1yewtLkrUN9i AXRhdbHPyUg7y1Sqrj2L6v5+8Jo= Extension name: n48e3981gh ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C9DA0EA57E115466

http://decryptor.cc/C9DA0EA57E115466

Targets

    • Target

      4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695.bin.exe

    • Size

      115KB

    • MD5

      be926a24f4118fc23f09ce4ecd9ebff0

    • SHA1

      4d6b8d954af01ff556aecb055f1965063ec3471e

    • SHA256

      4002b38c82cb339d1ccb434b5665389dfc33e0efb436bcc86928010797c89695

    • SHA512

      278b8c39930f5cd98660b2f770452f227947800baaa07a8f583d26d67bd420e3a09f44f9c625068e18988d50318c0d5ed97dc0600b5e60ad803a222dab969ca7

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks