General

  • Target

    d0fb6f4c608994c787f15ee3b5cc1297180687522ade080c07a708e55ce23de8.bin.exe

  • Size

    116KB

  • Sample

    200820-bg48cv92ej

  • MD5

    946a25739c934f91f795e002a9f77bda

  • SHA1

    48fa5f0d87d162f8ae67e01d7ee309ae8fa976cf

  • SHA256

    d0fb6f4c608994c787f15ee3b5cc1297180687522ade080c07a708e55ce23de8

  • SHA512

    07e6ec47cfbb44975ff7e69973c8154d8f26af1acb26e62b40e0003943953ab87b15a222b14bae7bfb74849f9aff36d727372cff3c3954418db7d28e9119ae69

Malware Config

Extracted

Family

sodinokibi

C2

team-montage.dk

yassir.pro

finde-deine-marke.de

delawarecorporatelaw.com

lionware.de

tux-espacios.com

healthyyworkout.com

creative-waves.co.uk

evangelische-pfarrgemeinde-tuniberg.de

anteniti.com

danielblum.info

blood-sports.net

candyhouseusa.com

ivivo.es

thewellnessmimi.com

xn--fnsterputssollentuna-39b.se

oldschoolfun.net

cnoia.org

nakupunafoundation.org

easytrans.com.au

Attributes
  • net

    false

  • pid

    $2a$10$SScWO6.3Q/iaFetznmEzCu6.L/hzoOxkFW04PM1A621Q.n438dQfC

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5106

Extracted

Path

C:\evlj584f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension evlj584f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CFD95459DCCAE4E1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CFD95459DCCAE4E1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2rbtCzuo3rC4AccohKsMo68FZ1RvRUNfStLAUH3Qyemu13z+fgJSiaRg07e/Qcpp l/bh4M7dNtSvMlPcSaofRjm+ze56qzJTeFC2ofivH6FAXf5n2NYhkIEfkpNvyv2D lNn8U0VITLgnS8HmVClSvGOMFsf7cNCScQVrPqPWcrgbvPvFPC1WXkiEe3Kz794w Z0amgT9XYKv/rLnHRdgXZr+hTl4nMycdaVVDC35Q3T5xZymxr8uvlwUww3uAQBrB OinG4GLuK7N2+ELapz5IzWI+eLpudYU2jDu4gHjKuYlKRaJqK15iBbWUJjnj7tKo SoXyo5o80riV1zV9hVRRZwX8AE5+TSRuLQ1XZ3UVORAfUK4wQH+8lcXKbYgNvveu NIqZraIoMdHaf+TxG40WZfH1rKPbPxHaLU10zeLp3Beg6BanmR18oAMaHvXHRDQT f84CUzWcYCQdWKRnuXqiWMEYcoWRbWWQ+HxhV82NVhl6oDi+6OXr3rw1939ZUJ9l bBjnKjR1hPUjuAbA8uA8DnQcc2P8p9BpAI/ZCv6lEiBU/0J4mAGIVaapvNcex+V4 yHcJaN1n34yGYAIKDrpdBf1Ostcjyl3VpmMOqKhlEh4a64MEY9TEkPtYEkTX5rzo ynCu6i4uayjIZtVcwOOt4CjTvvzB9rui0dVce8+zZfCuHv0jObc+Mi/ol98R38pO 8wjk3pGwrJm2FMg4r2rkwOX5KNTqR3XDYHhH9VFRwnKZKUIYdUn3qQVYWy3VR2RA Nf0PYcYmSfP96pwqhDo5HL/XxGA8bYurd70v9CMLwPvzVxnWq0Pnao1tNbcdzl8x U6fW7y/mxMhZXJ8DuSXMhfFze4jWAq3VhpC6L0KnH4Al9f1uUo2c8Bvirsrh94yx hbVYJRfv7XDcJZN4ECA02/1Ig2/iqQ8qPHWEmGlaakaEUpoLsdjHybGIE264EAmE 0PdqnDQlS4v3sKVpZS9LTv+zBLf+2JG326A87fwGl/6c0vV2tHkJQkIEjTDZ4YU5 hsjXkXVNdojUHAJW0B785733USiW+dBr8yV7oO5s6VKlG912vVJL4IUGhO1AMKSR wi0ei7Khq2bSChtdk+XNhOya8LJf9C55U2Ft5QZ+B9YLcUjVL+32JseCbjXsejCL 4ZU2T91QoL0dyZAkAQa3TX99EK9Lu+g71Tp5u39ZM/6KK+e2lMdF+I+v7QfCI0C2 GworFifCCsB2kxWqfe7r+80cOA7aR81taN4Q4EJE+5n0INsx3PYUtZGqWpHUnCTR RBD7AA7Elkm8uG52fPDIDPyRceAqVvJ561LIwOO3hSbavBr9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CFD95459DCCAE4E1

http://decryptor.cc/CFD95459DCCAE4E1

Extracted

Path

C:\sg9x6os19h-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension sg9x6os19h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4798B3F2F1587432 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/4798B3F2F1587432 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: F3swsH7uQeaVStinh5d33JYjqagCoxrdtRd1FpWy1KyPBLuefEqc2ZR4hlvHrYGK 4AvtFQzCPnLKUYqi7x4B3cgGbReww0a1WRwHmwc7yegY5fg1oJWiOrk49PLOSGtU i0tJlUlzXs++5pPVIZaN2SzdTgK0Ew6ZCEwGwCuF0Zb2z3UojnRQOId6wsJIk9KY Oj4JvVF3nGoHOKz8rVItYRj+btmKn8aBA1Gx7kBlVZSyK8ISVckJ4Ghpbsx83yui MZkXolBOk8X7jQsSwFmSzn12xeRv0ExIsVpqB7F0XlijOScx08Nn/XPrPD3FWnbD puewhOsBgfBW69XiDWpaT2xtVpYGzjteU89w8RxsOclb4j8cBjtaY4iEGTLlZOc3 UQo0hTfVz9Ddc7RyMQS2b9wEF/RDNeyXRxDh2zwPRT7Uz4kUdjnIB7svnM8WXnQR V0xCtco3Bn2vG12KGHrANMP779dVGxpH7flxXX5fMl+s4QMYDj88FKez+Jo+xndW DFcd/I/y6p+wDDsbVhDL6qfjVSPXMB9aIvgCS40MM/svg76sWkKL5oLiDLY+pIKu R5IUsFk8AWSnf4hRXbuzQ7bZhyjz35irZxNzbbfq5aEtQicxMKHYzrMFOGTlY43F Ak4rbbKPyyOdnLbhPDF6LoVc6a9uY7iu28AW19rDcbTH7o9/nS920EJkl1a83pFp JdA4t+KhwLf8BxhDvIMdlT9d3ZrItbABvSXMkcq7xkcHAl79jadj27HpgGB+fVbY OPEAb/OA5Ifeza1Cp6P/OD1OzH1sRF3ViOeEBT0A+DgU0ggm814pYm7dGGkcQ7oQ JJdiYA3a1+b092IDRtpm6lbpmWz2pcwhDnyE3jYNp04CVbDGTsqtCoYY2xIngzzd R8dET4rTMur0nQQNGMtgG3oWsjHH53Iha+cyRNUgs5/VgTguglSc6yfL1TXJiXMS NolHu+lM+SOXiDJeStk+LKs7F3V9C1pHj6Hayx6zu3JkYrKzpjDnZsqEANFCrKh+ h2JiSWq2ZjiMv9Tz2/PsMksPB9Ka4wA3Pl1P4dMNSHHZRpW3IgzlijDdAPzsG8jh +mIY2QeBXhIApR2dzzlKF8WCI9ew1y/7X75L/DF2s6VSck6c4aTFITKUwofEx9KD K/qw8Yv2yGlAQ9Gl7vb//xybRWrnhKdTNJDx2yc1HKxzpdrg6cSPsZvZ/ZG1FEHA EpVh/6YMlNxfkt6HDQ5+knTayxLJSKDWJLQ2UwsutgWfcHLWNhupox1ndk2B6L1/ E8JzJLxlNY+9FK5PtSaTzw7o02vSuMSE ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4798B3F2F1587432

http://decryptor.cc/4798B3F2F1587432

Targets

    • Target

      d0fb6f4c608994c787f15ee3b5cc1297180687522ade080c07a708e55ce23de8.bin.exe

    • Size

      116KB

    • MD5

      946a25739c934f91f795e002a9f77bda

    • SHA1

      48fa5f0d87d162f8ae67e01d7ee309ae8fa976cf

    • SHA256

      d0fb6f4c608994c787f15ee3b5cc1297180687522ade080c07a708e55ce23de8

    • SHA512

      07e6ec47cfbb44975ff7e69973c8154d8f26af1acb26e62b40e0003943953ab87b15a222b14bae7bfb74849f9aff36d727372cff3c3954418db7d28e9119ae69

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks