General

  • Target

    591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a.bin.exe

  • Size

    115KB

  • Sample

    200820-qnnlefs8ka

  • MD5

    35766bd0b389c682306437d45ba5c4e6

  • SHA1

    b837df01d31c1bfff0e54f07076323d075a4bf27

  • SHA256

    591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a

  • SHA512

    e20472ae28857e4dd7b021e23366623cf6b3f9a4818b09c36997b1428220d244da760ff61aaa11de690278152fb551e2a002f7ff19e1cf60ad625845772930c6

Malware Config

Extracted

Path

C:\e9zkgun-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion e9zkgun. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1E0C9B09978739C8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1E0C9B09978739C8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8c6L6GSxppa8Y9fOoQmATl/qC+PVr8xhFOnXY4lMN1HwTN41t9RvT/DdQxy1wJQx Y2ZOLkQMQwfZ7MJMIiq5Plzy3pnqIWYI/2nG2aaMve35Rc4vlILONAZFV0Z+l79t EkssYz6RAoC5gzPa2tcWQ7mRJ8EVyn/9J4oFPfdxZ6kZRQ3N2gHuC6qHhIYKqpZr 3kG2CqRT2ABxL8zTE4Y8y9tlK/50Ai+W5rhz903nxiFUitLEECHe12K9QW9Tsg6V mdF6c+6xuebpSHbJecCqFaFBsuy5Y8iy3LTvBBhhBWL7pviHDRQ0IEPcBcEtaCaZ t1u9kAJ/awWlknsWr1yG5vLxYzbtBfR8c6lYJ/jLqxP/i2LPzmDo0lrcPorf6s2T O5SgbsdIdisL1EN4vswLF23bgNKF8gHV8I1WgF4CpMnrCyumXIdmn7D1EpcJKC2E BYl+ksW72xDbAQM7HpuFG0O0nwUUg/haxtABZ2s9SCkZQBXc+0uoLV4Qc/lKTdTT owIDMOGOiGWfn/Q6J6Gs93zEd0usarYPvbF8bZ/IHa3eI3iouMpv3dcXugL4Bs4F N2PKmIIU7Pk6w6okSO+LR7HVBKrsbROCX6HqyNKR8MSIEpo4Aj6qm9gieorsXtm/ YjSNTAvglPx3ITOR9f0KZTw9BAeJvuYVfuGCVaqrn33qv2A5o/10d0a/cyNwQi+9 mpenUAzBD5+hVT+lHvGPFDNJ6r4m25TVeXJxr6Zub+d/3R0L3HmN2cNN8Wk2ezSY eukTYqLDY4Er5Gqy28GgbTnrf1qdaPHHimOpqz0K3b2O6xhnIXRmr83+CIaksAH+ v7tr54lHy94PzIZopm3iW/LE8l2qWwMGeKKCGtp+3a2np5/XRijMbs0o2tZqq7E2 2HSgaskmjq8g387cGDheUIg1oBDi5iMu6agprfCOY5+k1zLYeIcDzAalOq45WVwt Hb8f6K/9wbXZ1BwXeLjmq02Zm7lDuiLa+KfUE06gOdGP1gm1wefK8dNoqizvIsnW /tNNvNMubV/om/iOjfgytLQCLSIKXpxrxv0hZ2zNUDf7Sxgl7mq+AZSClUeG+zYM XTzgu6Mv/D9OOrI5/QC+x32+3KF4k70m9856k1LRsMW5vxzoCv7i5azzBMd7+xH2 J8lgtomnAEjSs2Wn1y9F2MFfEfBfnd4C5bAgY0RSY4ZNLHDXty8XpkXSoi6a2F9D fZsMd2yqMEfKZG/fqa2HmO8P5I8n2PqhTMsa5wPK48weR6PLgRo68AT2ubM/vjkt 2X9RB5O0GILqRhjmVySCn0DCcemU7lFsBYfsAjmg Extension name: e9zkgun ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1E0C9B09978739C8

http://decryptor.cc/1E0C9B09978739C8

Extracted

Path

C:\1g3wd8r-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 1g3wd8r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/887C53C24A330C29 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/887C53C24A330C29 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1RkgY6+Cy9TZ/mCVYenJpC8tJXwkIkqeUgzrtC6ogas+jQY6EQNo8MvbJpLg2QhE u4rio/t7CpkYYwRx6JEP7EHQV/z75/NHVSkl/rfr6kyXc42hohnPsNLCLL3RGf3W OwonlqdPfHHE84t33S7P9dIQrnJw4wfucF3K0BZ2axDDNelE2/M2PsEVWMCL01qs Zyt9SCNgIPq5Y0G9GvUoOv3MKaOVDmAsg9UKLOYUnJhWQJ6vz1TTMlyMSRL4mkqW be+eBjzo/iIkp9YrcnnSLbODa+qyfm7M15BuffdwAw9TSX0dUQvWPqozX8L1o/2W 6gu4gr6eDJoT4DjLLnpIj+8MUVA2gJp+E567Yn1vCGDPCdtlwDK62Sh6jz9xdCqX KUwbdxJ7cOdHZmhtY+0kZSt+5MrPR0GBRNZyrrv4w7jlFewPHfZGXa1CwvyVCFTY JRPbuFYoDxurQXj+C2XhR0RuDXEYOtXQmwAkFK0H8EDWcwCiay2ZKmut8h4wKLnL X+0yn32eQHLHq4uZWCIigVMRXpMfL98JHN9a76pZGzzbQ/gP4bhqUFPwtu8jQH6z WF2CrtrQwKmys+OTcQ9yXvY2Dgd4Nr7vCHUQGcWMgDQRes/+A0NQ5V20PPn6WiZ1 waJZghwFW/d8m4ouXc/x8JKDhhqtC17gxfK1o0m7/iuR/fSNqEpt2odMEM6kvmut 16XpEjjLE1PHksKS1rHWh8yBx2T9zPGwI9WmzuJYKZhsTyI3J5bIvY6vB9mr+QtR JUVoQ7iBy7Z0E+x4gwqB0I0f4LGAYEcFoc2/tsRj8Cmwqex9GJcw1RVwgnEZRzcI O84PlTl5DXFkgzZzznTwjaQYkPb44qB0FldSEkGfhG0DhqqKN2JbJZUNurF5b/N7 XV1J4WstFTV/H0ACLCacTvuTHJcSfH32/S2Ue67PodcL6unCLE/bcT2WhdmatFcP uDeQG9jdVKJczLygfYIbzjrs7a8gYbr7LaUrfZdey2wiQXJquPn/pm5eVfFUxk9C g2hywBq8QLKlfbvVEBU0DjNu/U0OUcOUqDNYiyEzdy7NkB/xxcMuNsOdVum4rLPc xMyfgKIfuMaQFzmDPvJL0M9Uwyo8Ft6H611tOCtlpieygCr7Tsfb/uAy3Nhb8qyR rlVBdqrGP3+afq16/Y60uqhWb8jyUPq6XlOQxu0iePZ4QeRa0VQghJ9qwjUbZoMy yX+zv9G8xDiyb39dRwUVtb+5AvqOL6/WbKQuEapWEOKHRzog+hIuOCUzDMKtg3CW KEfaxXLL3HF+0AezOiQ= Extension name: 1g3wd8r ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/887C53C24A330C29

http://decryptor.cc/887C53C24A330C29

Targets

    • Target

      591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a.bin.exe

    • Size

      115KB

    • MD5

      35766bd0b389c682306437d45ba5c4e6

    • SHA1

      b837df01d31c1bfff0e54f07076323d075a4bf27

    • SHA256

      591d971b9411860904bc7fb9234d9069e3e8cacd06523b0bf93547bc2c4a827a

    • SHA512

      e20472ae28857e4dd7b021e23366623cf6b3f9a4818b09c36997b1428220d244da760ff61aaa11de690278152fb551e2a002f7ff19e1cf60ad625845772930c6

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks