General

  • Target

    zmsv4JeS.exe

  • Size

    116KB

  • Sample

    200927-5r5wq4akln

  • MD5

    20ed7ed36e052a523030ae979e872793

  • SHA1

    b686ea3f47c254082c584ee9d18d386af4e0c870

  • SHA256

    bec5d4b9979a2094fe1062512ea2754b9ce573b879b25167fa8a4f52f350edc9

  • SHA512

    7df169ae3bf9bf85205a7b5a4d5ed33aed897073dc003a7ef1eea529473fffe005b549bd72e9f098ed958c8a5232640dc12928413d0690a3b6692ffd0b32cb94

Malware Config

Extracted

Path

C:\8292t0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8292t0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DC067BE956463111 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DC067BE956463111 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: CqMI1MdALZARC2e1FH+EBi44Ehqn8ogcup24Fy032q6N655wg32zpVkY0ASPUgV7 rIIuNvVOeS7UuLTt4ddzIb0w6S/4L90+ahvOPfPuBBKKRNcFZ130CfBJGnSgQQTH eGXGwwQ9GsH1tt1PX4rCetd9qiqZ+Mx8vVm6l2nZr2B+3UTA3u6f+wG2uMnC0tmo bZQtevQyUKEWKjdO5YzMzpJBQzYS6xafwi0JJz6+1fFZQ3Ym4kk/CUVpsz/YsAiv sct3gtSy8Rd0cigX2bcYaQ/hPRNcJ4fTS0Abw9njxIgGqufAmifSuriDLBzraDkQ 2G4oCQkdqrjGcq+DqyN35BWIUTAuv0OSAS6R2eVoEZrIdZiNP0qTnIqqaRg2w2CX 044rds+rScg/HvdoVPXd3MURsKaLP/zDh6LwCTYc+iBsN1mcwMTzfkpffadpXCQi aQLMZPi3T729Fv24D7Y6mUWAeW0M/i5aDBFzDsEao3n1w9pZfPvbysnYB489sVjZ JVxzHrFE4aLA0BG0CUXlT8sRwkLz1fe32WcnF6O+xvT+2r1YjD6rd1gHBpHNEmV3 1ZA4vn5aucUOM6XgP1xfgnq2pBIQmacgm+MCei3cwVkTU/viTQ8lwoAuUZEVUFjw L5Ws5ys2SFkFvpnGgPBWFSoLinQ38kwA0OY8mg5TzV+g8AyaThAl0suuwaRX+adR BbERaKp25998fj1Tw2UGEHSNH2dCjMXMd4gM6kOBNG5HParJbOOWcDcLL6hXB5qQ aBAAtDfdSSFEGrpIdUN8lRoRF1iBGg9LINBjp1UGipcy9rs5hHoCfVvrbOLrQDcx NTQXAFRcWVexEPNznZQSd8Vjmd6ANyFkoVxszmasbnPRbnLs2/5yUqBxWIGI1mDJ NlU1Fi1f8ivDpyEGPnP6u21VrwEtpzZljiGXKiqOu2k1levM0Ix5OecNp6sKK+Fe 01e9iTVkthYWoHql7xcf6v7pN+8CWE8U+DXiGnbUltQKaeN6KndVUW6XHt1Y9e7q nXdHyHywTkL1vNt0EsoVvmmU1PD0UPClH6+aVzsr69+F76Dcmrg0W9JGsqM/E/V4 Kc7lAjakBllD2YTjsHjsj9nCagtDv9eo6gbZw127m4deyPLj10zZaukRNijolYI+ uIOGK6eRnzEOkVALAi6oLIcWB2++r4kwyeslM7VV9VzJVk8Ec37kVfi8Kp8gCV35 PK8wPHZ1NeG6fCDO1VbWia1VAS7PFlYNWJcKd84z5x6QgwwjqNAV5HPfACHu9a3N FEshZkDMjadCi3RfnhN4VQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DC067BE956463111

http://decryptor.cc/DC067BE956463111

Targets

    • Target

      zmsv4JeS.exe

    • Size

      116KB

    • MD5

      20ed7ed36e052a523030ae979e872793

    • SHA1

      b686ea3f47c254082c584ee9d18d386af4e0c870

    • SHA256

      bec5d4b9979a2094fe1062512ea2754b9ce573b879b25167fa8a4f52f350edc9

    • SHA512

      7df169ae3bf9bf85205a7b5a4d5ed33aed897073dc003a7ef1eea529473fffe005b549bd72e9f098ed958c8a5232640dc12928413d0690a3b6692ffd0b32cb94

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks