General

  • Target

    f97175fdad804a02e6f24273b371184d816044eb2409dadaad683c07fd41e992.bin.exe

  • Size

    116KB

  • Sample

    200820-g3ap1xhwvx

  • MD5

    53fd5fc16a31ab15167c9a804e3c7c14

  • SHA1

    88b14c8f851f04c9d595ff3ae441bcf52489df08

  • SHA256

    f97175fdad804a02e6f24273b371184d816044eb2409dadaad683c07fd41e992

  • SHA512

    085c5f4a8ec87c5b714cd8b4016170aa97ef80b2ec70a175f10e3a7e6c83b76aa30bcf76923cc2621fba42ee7015e452814b7d0f42f3de2146c2284a0145d3c0

Malware Config

Extracted

Family

sodinokibi

C2

nativeformulas.com

theadventureedge.com

delawarecorporatelaw.com

helikoptervluchtnewyork.nl

maxadams.london

abitur-undwieweiter.de

heliomotion.com

ampisolabergeggi.it

365questions.org

raschlosser.de

zonamovie21.net

beaconhealthsystem.org

falcou.fr

gasbarre.com

innote.fi

maasreusel.nl

kamahouse.net

johnsonfamilyfarmblog.wordpress.com

wellplast.se

vibethink.net

Attributes
  • net

    false

  • pid

    $2a$10$CiSbUCT3N86Tivzrn5ajxuhtwE0qFwpQG/5CylTy5p.9Wub9Q3Vd.

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5128

Extracted

Path

C:\2f198om7d-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2f198om7d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0A185E370551E4C6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0A185E370551E4C6 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wopt4s9ZGdhV07QA7xH/RVRT3TvbjLHUsLn6Lhdj+wTJgloj3VjYLecx4tYtpgjW 9yxf3tys7D9oyY4gSF+qP3Ixd1aeaMB/Cn4curivAxc7FALCe4RjHIuZTJW5mAYR rkWFdtaNHaVJ/8IIwwl1CEbjvX5+0OyKKdc27HTordrfvcKE5yp1emZq/9ahim0W e4UcR6H+9Symg/LikVnIgr6CgSwehHqVCGM45cy56Ya8kKhGQ+3ktmO8OrX+l6iQ 7wz5XiaLcZ3tHTXxWPe8GB87bOAL0FVHjz2zbkel4Z4qhPIVgWY/oqmo+Hr5XTQ3 059jQ2lrbcK5ELU9nZLvhumzBaq/ZLkrh9MncyanWk0eOs20Mai1D/gsU7P2jOeg VcBRqRyJ13NCRThm8PK/mQ7QnuoxngujNkffi4bWsTM6MgVe4ieRwd6Edvrq/0aZ higSVnIbDG/9SYk7TuKLdy+VoRKHXwJ3aYxDjbUcGY02JcKGWOKm9xZimLPSwszh YAaqpLW0iJ+BVjVgnGRICcZXnpC8udHxnwGPWIaR8fE5S37hA5d9vBBOjGhfK3Oq f7vLR2cKNQMkmkDPed1mshgRzpgjYv9GHsFwVjivxI9Jzzy0GvCEBMA/VY2C4z/R zux2R+OdGfBZ8q0mK7kayfqklmCeVfB4i32fwXrjmdB9VLDPL2WrFhi9EQ/h4wd5 pTmNHCxRAhaXViRlRvMDWe68ZKB4CMag+vl5OhPwW6mLiVvYz2CdzE1UfseuS9Ue dosuu3zPa5qFNPtsJNkB5KJUoN3Ur5vYKWmJsNFKsFwOc409DcC4c7Vy7n1MJ2Qb 8NC0G5pJqgVoGibWA5cfziD7zgJl7RCo1oPLea/w7RO68fC0kd4Q4wMSKRtkk0QL I6IA1kw+YfNSoeGE+jYURX2+R9p5t1UbMH5RyDAmTpSlfJE1ppuUjpPinzuzZdiJ hNBVWMymx39aB5f68DOuPgsMaqR7Fwqiy6ueia6NXO7UImc0sVhN/HLHFBRMH/qH RSPxGDenBFkWL6QxwgH3/oBYVoJ8NyRqv3ElQmwo7sD6xIOcYHLENX+nsxHYaeUH FuZjvS7AUALX9cm8rwBA32v4CpFXzSAvZrov6GNw8cMfTcLXgxS4v+08yAT6bphP YyiMKjqiV0qT48W5WQ9jZEPmlyE8py7kq1s0mC8D/1TXdFHmLTeme/341VwL25Ek b6hN+6YkltuEBW2BXJb2Jf1kc8OCc9K+7DQjZa+S74Wk81hVOedGic5go02Ij9G0 4V3RZ55wQb3B5JxcIOUfIJYQP8KgZ85dIye4ZjaGnVAaIEkTYF0= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0A185E370551E4C6

http://decryptor.cc/0A185E370551E4C6

Extracted

Path

C:\r69548y0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension r69548y0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A66F0878FB3BF952 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A66F0878FB3BF952 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Y2e26PS2bZCEi2kjvOft9+/53i/wOm09W0Xu2CtSTuPbP2J01CWlcR9NUV+jIcNV e03Wv2/zQLa3gs6rZ1s938DKRwTUIB1hjJVRq3I8HqSbChabi1Xijt5ar2QPMKcv IQmZIgzD4dBlN/gh8tywzfj3RCLBesoVWT1NzZ/irQq0IkWC6JWIYNpFL55A5Ebp jaPMP+t4JR47MaNym/BBDPbC+OZaE4QecIET5N3rYgd5y19S0+s/GH1Nm6p9TK42 Lr7EwUW2OmzUaRZ7KKtjxu/W0HXy62TNKuUA4EJiaZnXiGO+hBRoTY/S0XjpVSLn Q5hVSLigvv/cRKUDAzpLaYL6qHKqcGLnoq7Jqq2izTGM2tH7HyZ22SoAgvcASchH tm5hsyiKexPUt9wSd6n0iKd+rkfa/NWjLw6EaUGU1fLJbxvTB55CYt3bI9abs+ah jjtTx5f5prFSwx3+Mhcea+pWc45Y4RwEhnpPgjTFjtZlyit6pQrtG3U0AnranJMz ekYdkMmnw4qhj7dAwxDYQSkRS1ElpYe4FhMKbb3GiG4nFH6onACaF4lq+t9W+fDM p05WYoB0y/LqCtWzRpp/BGwv9/1+8yokWBQD5zRFZtKw/Ji4CHAMz6cAC7aWUDUE 7M+n7zPsxf/OWpF6i5TJiMKUrMDI/or1G+hj8NstN1CKh0LjP5FQYObeKWC9t+hn Lqwb0Q8PuJqutkg68qtdU2dvBlRCwdomhtoDfxkxje/fTpGUuPlEWRNH7i4EddoV QGBgRHfz7m+zPTmXqUYrTOieOJyJRFvp4naNDAlocSSCpq6eTEF6Eph1vViDYd+W oCYHPEs9oRBMo6BQug7Bv+qe8qTjnUqsjRf5J2jG+QTDoR5hYQbkmj9BfB8E4wHO LSPA5WDco0F5z0xo2DJJyfI7uuHaAsqeN7WXetn98ew6OWaeAqGVOi83oxJ5pRzK m8yjmnJP4uo8aJgUPCVihSkvNDHHMj8cz7UtIiMFvE3SXE5vcg4/ZIg2I9Bwq+7P bAQRvWuHZMvv/4XgMH0E26PyDtj7rs8SpS+QgJyqiDdlrayzFr/jwehpC/vy2R6y 7hnaBvmwF3I07AlH/1xNOGrxQwo7bEdevdSjHqnh/a1U7BtY+vIwRIpNivCHYinR QGGjk0yAIMZNRHV30ZMbigQ0Q1fuqH0vBqhY6o5s0lsaYlNbJ7XDpr3pZZFRqNUT jChbrt/rpMIwA3nz/L0S3fquIAV/5MwB0xhzYUMMMGfhhFFAkyXFgbcR3yVUctYO uW+EWOiLQ2CUtPx0uLY8gNdJ9sQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A66F0878FB3BF952

http://decryptor.cc/A66F0878FB3BF952

Targets

    • Target

      f97175fdad804a02e6f24273b371184d816044eb2409dadaad683c07fd41e992.bin.exe

    • Size

      116KB

    • MD5

      53fd5fc16a31ab15167c9a804e3c7c14

    • SHA1

      88b14c8f851f04c9d595ff3ae441bcf52489df08

    • SHA256

      f97175fdad804a02e6f24273b371184d816044eb2409dadaad683c07fd41e992

    • SHA512

      085c5f4a8ec87c5b714cd8b4016170aa97ef80b2ec70a175f10e3a7e6c83b76aa30bcf76923cc2621fba42ee7015e452814b7d0f42f3de2146c2284a0145d3c0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks