General

  • Target

    8d1e4bb75799fd3639d12f2418ae31631e483f8dd9758e1e8ba785c4e7a18a71.bin.exe

  • Size

    116KB

  • Sample

    200820-aqx31bqt1n

  • MD5

    6f478788c9bf905bad3371598255fe71

  • SHA1

    137db4ccf35660ab2b7e44b29755b363a93736d6

  • SHA256

    8d1e4bb75799fd3639d12f2418ae31631e483f8dd9758e1e8ba785c4e7a18a71

  • SHA512

    29633d24fbe3bc50d08827bb2d9ec0b48cf4895ce9387412f04458ac283540c0bbd710e71d61a3385fa3590f31fab41f316e88b8e4994811fbf1e6930e805085

Malware Config

Extracted

Path

C:\873s80v3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 873s80v3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8450E640EEDF2E83 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8450E640EEDF2E83 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IQgst7/Aw0+T+Y2Kx0XRxDMvoY02BWj3zbj/rt5LVPkq3IUQNeypxf1YE0oPVbbk s2Oh7PYZtpI7Y3wBLclW1UF8U7uh8OBZOXrf4ojBvOPamcZEPV+kK+y0WjF0jZsR L27hPlmvivp9JZhFulx39YCQH7WJSJrR85IULEpibEU74gnhInxGNOCpQmFJUFLj XCRpDoO01+/pzThOuQyAaXRhn8vgRJR79rpQo41BkhQ9/UT3VP1ppED1Inw40nL+ eU68w664s6EdaVbVYYac6FrgTmdlq3mqy+HyUPJUfIK/xt1IqYg2BG/U0BiBXwrW YNPGx+2YoZ+cEoqql38MJ7naPLUk9abJhraQVLOBi++X6KzIGIUxWEsB+HM5WyDp 0vSh3wwUN9eB+FOdkW+fsea9bjxi38KqNQExvBwu8FPwrr0lxoinAF6h0DnOMfwT HmvFahn5+ZmiLY0cBdx0Slwp40gWJ2gYlDfe6vdtHSuDZIq4kMsy4D1a+5eWXBs6 gkcOySEo33TBOlORDIaDt5LOG7YAuGX/pgqZGpOx/AMr9DXNiWjYbu2fuxZQ9EKy 1uRDD5Wr+/8WdUPYNLf14EXbNQVaufayliO3bm1g7KfBvrzAeoBg5Zbg6jqNAAtR 4ASAe1X0vQ91CTyyyAuP3eJo2sJPt7lQoq/PZng1SSlLyQsAPgH60/Ur8OyGb8A1 IqXXRI0a4+Riqc9gWyLqH6ouLUW6l/zO64WQkvmwnZrXvXY8kHodIzSG2NLrRhOf myG8yFmzM37bGx3ONLQAKq28zce10T3IojVczAJI9yOUDg32Ks4g7xLc4qidynVk P9zOKfYTpoZi2BOLqg6vKM2vlxFOvARjsz3Nl+JUUzD1DEjEDFYWmdrsa6ZEu7g8 Ukuoe5AC/d8k6zGG9en03PyposKQ0jhAhpjixuB+ElD8uvNgwCOdoY0fleHtz3nH OLD3rcwZ1T63v8LNnQGX3CDw8k//7U8yV1VOyOZRKEL+Ohvtgz7sOAOegJ4Ixewe xDzKQRyFDBd/cO/xfu0I9Rj9gAu/FkxCqWB9E6B4WHcS8xr4TskJRv+CT5rSVt7l Oz1N2dow1laG2vGlMIinT0/mhBBavkpGJJkffftX2yH6b6qd203nQ+qZ3aF9eSeA OD6ghjxq6niS4B0Og1/tJLhMsX+OArswdcCGTkpN5yNieXkD+D0GgW3Jw55ulk2H r0ZrIJfuRKpKH6ipVm72vos7wGjBAao2rvpOeN2CDYdgzOwPnuIClEsrn19oO0Vl Yr+Semlh1WRPJmVoHelKoITGHaXBbg3AMSgyPxZhGF4= Extension name: 873s80v3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8450E640EEDF2E83

http://decryptor.cc/8450E640EEDF2E83

Extracted

Path

C:\z2z8459ig-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion z2z8459ig. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2122EC22BD4D0BB7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2122EC22BD4D0BB7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: eXy8Dgx1xqd4hoXVbQH1HMqZ9qNLeOJ7qJRF6ueqvb30+OfDvlWtcvieEl2nHvK9 S8ic9neyEMpxg8pOEh2oXOvKrnmIDWigIunInUF0ak4Ca6VIUWySvp0J3DzYJVwp ecHX+4T8zzDwuIOwt9tGVBiVHHV0srlM2s0f+4hXOcPrS8NMIAX+GTLkcLvSofYL 98qcsf57dBWJpRL+aYw2gNxwFimLijfQLPKxjryCGN0lnj0yp4rT1MD2LRcligz3 LXw7Y86lysNXpmlWW002vAvNaeExJl+EBVjzOiyIFa/L15lj25RddBNKdHHs2RWQ FpYlHu8Rt7KyDUh3H+NZHnuG/P8oVXNS7MZlFMZMCeHDKMDmHfIhD6KKrY4LnEvI oCLo2RL4Xq4bidIMBYlyuwPzhw7VcgN6mf6qJPLXtLrb/qJpFIUGdbw8fEM1o2wI Cpfe2KgO+lCGlytZ48uC6EkXiwTveIIuW2fDhMi6zYWKYSjnCTYwwuvvVLV+gbLJ D01QgrvuiiseU1R+jJsSEcxk45h3+QWjuwFcASKdX90eTo3bM3zMj0Ise1/4d+NJ T118LeCvleEuSmPggeRb6hNp9g28s+S04WTvK4Ya3r787GVWQULJfl7xNC18V+Nt PGg3RfmFNY8tAdF8DoYtouBgk/48zD2iVjdwU+9gTzgI+yymSIY6Yi1kfpbdyglk uEM1Gm/+ZFA50nexBByYkWiiThIanrosbKzFV6RMWP3olloiKn+KtoelefCfOXNH Lpjqeo8j1NbGWUSX1cGs3VtUi4VzTxsVaHrvk6uPIHbvFfyui9pp30I8oIndpDh2 pGIb/sD6hhE+wNBEAsJq0rCKxYhxKnw7SCiLsL3/bIMo+IB7GbGR5fbX4UXqQIPr 1iA2lp/xT4j62aT1zIbqR83KnHOCUKzQ3w10EuxA+7qkjynxzghznGXdeEN+BMwB vPRNRxIahlpX0fFQM0JdNHDSE2XMrysQr0e0QFtLWvNWbQW/kCn0wq/7ID+EQsfd bMevpHTgVEtQEZMKPEf8LyjC3jBIDy5JBVWbPtVWcYAX8nPuSMuWNUjegvI+XIQB o8zPpjhQP0NRR9WB3x/Jw0YEnUOYqxayErYh/1L4+nUoMt39dewittMe3rPQTtBq B//vEp3yaxRYnFTgHkIaaXYSrzd3Mx17PuihSDpcURf2W+mfz+c13fRJeT6X0kzU +CQxjLo0ns59y5aRYDrFP8GDYtqD0dQVOf9Z9cfQxokmQ9kzk5OUFv43sR+XW7y9 WavgD9zrTgLrBOCP+Q/6eLVw Extension name: z2z8459ig ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2122EC22BD4D0BB7

http://decryptor.cc/2122EC22BD4D0BB7

Targets

    • Target

      8d1e4bb75799fd3639d12f2418ae31631e483f8dd9758e1e8ba785c4e7a18a71.bin.exe

    • Size

      116KB

    • MD5

      6f478788c9bf905bad3371598255fe71

    • SHA1

      137db4ccf35660ab2b7e44b29755b363a93736d6

    • SHA256

      8d1e4bb75799fd3639d12f2418ae31631e483f8dd9758e1e8ba785c4e7a18a71

    • SHA512

      29633d24fbe3bc50d08827bb2d9ec0b48cf4895ce9387412f04458ac283540c0bbd710e71d61a3385fa3590f31fab41f316e88b8e4994811fbf1e6930e805085

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks