General

  • Target

    55.exe

  • Size

    289KB

  • Sample

    200825-5hgqe95wkn

  • MD5

    500286eaf9eb11b34eb413bb0df5543b

  • SHA1

    b889ff1138b2bd7a3033ca4c4868189dc8588f9b

  • SHA256

    f67d2bb9157ba5ccacbe051ac737812226fb2b43fe209867ae276695a8a929a4

  • SHA512

    65ce297688900f0c7b1eb3a327771eff79e366290761613b364f463787f66a46d14127e1a644b5fb8f26befdf90ce100110cf47107b9457f971ca8056402782a

Malware Config

Extracted

Path

C:\mg6590u252-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension mg6590u252. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C3DAA270FDF09AE8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C3DAA270FDF09AE8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ThCsKQMmFau/EiWMuMZxgMlaDLEHDOxqD/hE0xGRG7QQG9/TQ5WTGJYbItVgbKbz iBZsPkRvKWBkeqY1d6CEqBOgEogCAnuxWIa+pvCD0d8oLlztIwudlerJv0yDXDu4 Ouw8en+x1TjwbGncJIt+AXxRGSCmqWTSASLWrRJfB8wJgXk4OiCA5IChTow/VNX3 EEkwXSW8jLJafc/gD/llgzGnNTVblmVFgGX8DBr9/+1dWT2MzV1FwRKGSnwk/ODi hycb2GqlUAHdYH6qVYnHdwFfpGC13/Y7DZTJorWM3AwCClnCYGSDToHWxo3fkSLX FrtrnAPwzCuMFY/5k+le6TjOLKh1EuI0ow4qjXF+2ciDOYCcYWDfWwlNilJLqaVO kNHL5DXIaRYdhBt/3a/hTEnBOGNa2ZEAivyfRL8GilhAri95ac/sQ6WT5BSKHsXy xq/QPB0f6hfL8axwOCKwlrh8CEZ8UYn+ApUeUWQOTYrTFTZh6WNkpCnlEiVlBaZu UiEy/KW13wDajoxpl78h4fo43/ssVE8Q/zYy4P/xmfNFc7z1mk06DNT8dow+Xy0P 0+tzWlbNeHqmx247OOMooPhtxdCGFpGvOyJwvMzcROFE602fuLEE91LD6IiGpyIW hrXk5P54HRMpfOu0NE7z/t6b3jM1jICfJc7HJT2AJzcWhq/EQRR8ms43XgODUQ4L QjKy2kZpeV7U20wF54/QP0z8pTcaPXkWsaUHdYbAC4/7Z4LeXoavirgSHdL84yru 0kI3zDoGbyMS37sF7XnmM/7gNq5J7ZtNch/vaD3IaESNfCkI4eTMY8Ch6L4sgnQ6 /C9emm2MvM1r0dBUIUXiNBc49K+Ko5vRPMCwdYpr8ne+kq6fdh8shHnXOGi4NyVA DhQhYTJIOHOYpbRANf42RH4P8cXdsoapkMagJdzYCMSjIpiOXTo58+pwyI4wPv/I IBRZk0AGr48c5fWKZcpNmEzACtMtkAG3N7e5YsQRB49YuTdPHChjSYklv0/NQJ6r PKL17cooS9749YMhXJERX01h7afw5+uMkJHWThXgBmQXqD+BMVAMSeJsniYztZXZ syzQwn44RljCKhlvkhuPak/zPQuDjj1RnsRxEOiVQ/f7aYtVBgB/odHDs8KbQdNA pmwnWKxaVWwvolAHMCNJOyB0fFhN7idtLKSFro0mIwbFQrnCKjYRnlv3X4YoTsHY ipAIGNF+FlDpsDbQdo2iwmIEk0BjRHmif7y7dgkdzTqRofrIKkp9B0IagtKWZcoO 2w9XjkEtS04Ul+84r2Par6gMDm13P2PegJGlfnBKi8ca7pMkQFyn3g== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C3DAA270FDF09AE8

http://decryptor.cc/C3DAA270FDF09AE8

Extracted

Path

C:\x16q8vngrn-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension x16q8vngrn. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5B6E9B7957F638FA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5B6E9B7957F638FA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ZXZQVAbKL3p8Iu4YGSOY9Ql/afNeRgvexSAwwTC+EfkB3rWsYwf5vENXC1uIlRer SlOYs+Ij7mcZ60kFKWcWRobxR/HgpvBwYqU9JWSvCDfuLLTL4d7fno155U1eILRZ muAjoVSdw2svFAfOiHhOFxzs/jhTLi5EbyKoiCu4tT9H9rBhRQZvzZMOZfe+6/QJ RKXtVtl93evpmHGRcdazUhQC6CF507mCLid1N3sUqj1MVN0a6AEJw1eIub5Xk12y /r0POB7lrGfdqHcohQcTraiTFruL013zPxkY48RYI2XJ6hJe6uE7DKVJO+DN0aC4 FlYCaZNi93znZM8Nxrh500vzUA1els6mvjCnvWJSL0YMo4E810QC2PknGUQR6tcf KHOd+QsqjTyLM3gTRkEP7ZolmGgnRFrd7BRD9n+az2B8FWLfYcXlj9+SPPfyDG6I xqjglgCzSBN2KfW+XVbepm03mCU2P/v99dxJExgxZfjtVnhm75jAQYbEgx8JOPRJ C/NMBA9GJ2ZXaXq6mVO6NKLcI1pzIOsCoI/KIg5occS7VFdNSwsLx9lpuxwFgwL8 TEBhQmfFug80dx0zRP0CJneSpJjUF2dOxxI/Q4xFNVR1HjVk2p3b+8ChfGMKis3g OkoMeXWxNUf5wIPXKew/MWTZ6g/5QKCpqPAQPnYDqHpqHo4NSAlUDFMjjcqF0/k4 bwclDO+edPm7vRtzbnaTMxjAUkXyt4T5dXwpukk6dlNFuJ7YbmhH57naKXPJCNl8 /9GyWmk87TBBBPSdXSP120mpYdfXEtn+S1QqGuFjrPQ4Zpq4Mpm7HNg4HuO8pAZI YWqTx6OPl+RzHys81oenCMwb0kkyJnizO+n1Tg0z9sKpu237OhMngoCv0noo8h/e 8eg6FqOPXbsN8abFk+ETX2FluOC4WPdtGii0fUsJx0FsOltYbmrRfot7HqCqh7/R 8oWI0+gdlQdSP2NYlJTnQAFF6VRJguSY1EZtV/kON++yQWNf76ydA0pEWqhj07xN pq6ZDSJl6aToGs6dy1YzI88S3L5lbRVsacOMVM2Cclfh+/DWfSGe2GqOX+hRQEb1 FMzrM1SwcgRz4KcyccuenoHpYofC2JEScYF0IsECWNrXy3PTL03JDC/dVriE4TKc DKSP/upyoG4RzuJuohAKPayZsry1/h3rglxyv80qZDunfPr1RDlW/CX44SkNuheu z8ejv/h3zo934uV9KJrmMqMESC70CC/4Du3PYFnWVlircMwNXRtrUxPviecsA2gY gRyVVdlsE4ACSsCGh63uY82w61nLX7Zs ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5B6E9B7957F638FA

http://decryptor.cc/5B6E9B7957F638FA

Targets

    • Target

      55.exe

    • Size

      289KB

    • MD5

      500286eaf9eb11b34eb413bb0df5543b

    • SHA1

      b889ff1138b2bd7a3033ca4c4868189dc8588f9b

    • SHA256

      f67d2bb9157ba5ccacbe051ac737812226fb2b43fe209867ae276695a8a929a4

    • SHA512

      65ce297688900f0c7b1eb3a327771eff79e366290761613b364f463787f66a46d14127e1a644b5fb8f26befdf90ce100110cf47107b9457f971ca8056402782a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks