General

  • Target

    3229A962B991674C860F617BBDECE645

  • Size

    116KB

  • Sample

    200928-lggswbek1j

  • MD5

    3229a962b991674c860f617bbdece645

  • SHA1

    5c4b231cfc58ce193a78419f9326efa2d2f0e6f6

  • SHA256

    1363b70d46c3af4d0794ecf650e3f50ceb3f81302e6059e42d94838e9ada1111

  • SHA512

    4da8a69c7109186f0bf51cb656a406de509ca8cb48ce05398b32e687468a79b595a3e68a7d9eeeabe4d4eb0ef68e86b6b43b59793c167870c457480e48fd9fa8

Malware Config

Extracted

Path

C:\978986v1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 978986v1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+]WE HAVE STEALED YOUR DATA FROM SERVERS AND ARE READY TO PUBLISH THEM IN PUBLIC ACCESS (USE TOR BROWSER TO VIEW)[+] http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/151?s=868059104c94b3003e6dc66f0ca2219d [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BEBD9D7EC528C535 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BEBD9D7EC528C535 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: kLkWglWDQe40uvq6bR3IkIdK1gOPt9CrfSr4MHp6ULXPgHQPOs+/FQeS1OXKVjbX qoWnwHDI8H/+yrYzyGTdOor/UMskK7Jgk/kgtwgnpSQ1Et4ZEUupoIrhoku1tjoV zZLXRAlYXsKoquyTx8KtzYJV4njo8x/PyItCVM3MXvxEAjwiNSKhzsboPGvnMVh8 y0RDF5BJaXNdGghN1TKq1fDSxwTeRO1bZJz9X8pcgdjIgPWly1yfqfbmoyA81cvq lJFtB2FHjanvusRuElKSkERAHtJjx1dHlGbQKFfDKwbFntUpUjbroUfYH+a8Zw0a eiW/i16+8W2aX6V4ANyuztra76EvQ7+xiCfEB92BqBbGU025VROtdIscFGhhyRN1 pDOr9I8z9WsFKvIPl86TYNt6C6vVAROrZakxKkRmEkf7eC9+Bb8nbjDah/KSI4gy W4SG7+25n7N+3I2q49vfGdQ/+M/DZnbxxvsMaml8OPKEb1i8ba+DsaXF+CMgYpyb gBWDGk4VybCqhcGaBvrcbbHvp0HChZS98N6X86Pa88W/8Dklt8yHce9duJ+IO2dL 9VIqo3u77QTcbaL2XBkr67kCxZ1JnH78oFwHKXMgTJQXf/MzzbS+gOP2ZS4QZHkz 9DxwpeycvnGN/QkifdCNCCDBpWU4ERxBxyB/FTBWDYjSDkiaRIl3Z3XWOqOM8ohS ib/9y751Jp75a6IJ/p+M405SJMH4AdecNLjPfEI20xRwnN2keDaGzc9AnO5Mi4iy nPVjELE8SrszxojHZZxM138NEIGWtmjqudFIUZjFjKsn/NB0mJQvl6rsoOCSGeY6 3kU+omtSwsCLNCHCoZM9R9ab66RsJ9hK7elXsxZlNV6zMIseYQ5+efqXVOsy3mAG 2ur+vlOxzWeXvzdzO0m3yrkBZrCCnovwr1cBHycJ8H+eirQV5jASl8tUh2vp4jpz qzWBjqlhLyOn015I8zm9oVR90vRzMWOIhiCK5vJ0YNFFOyvNzYJl853Wb6LIZ4gy gnvNCPtDn3A+klGUVZTmuiwukVK5AJPnsuRXw6OdIwzgunluTwZ3UP7zORzqSgha HFRnc0R7zGlyNBHDiP3wVaxFaXtIjSwhW1QhuZ24qreA9a6eo+IqdzXZXgFscf1I cgzQBMdxDwNehq+rrJovvrYeiNyQmvk5m9X96EkJQnL3Jt35Uzzy6+bjTBMM/4VF TYEEAwpov8Plps2vDHi68y2rFXFzjnQ2bzvjHwQr0UFB5mv5gA1F6rGWZlFFRmDB r2uA75DCApQIMQTmEYDcadwjReLrqKydzDd+zb3tZAhQ7eM5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BEBD9D7EC528C535

http://decryptor.cc/BEBD9D7EC528C535

Extracted

Path

C:\q9au1z04-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension q9au1z04. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+]WE HAVE STEALED YOUR DATA FROM SERVERS AND ARE READY TO PUBLISH THEM IN PUBLIC ACCESS (USE TOR BROWSER TO VIEW)[+] http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/151?s=868059104c94b3003e6dc66f0ca2219d [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F26692FCCDF3E2B5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F26692FCCDF3E2B5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dv8U8eib7QLBe27fv+vXiF/QAoswsArHWQXEdRkeCcFaJm562EIuyHQXOFyPkDmv ww8v07cICDMgbpQ2tXrEDqm6nQaxpHdk7kWOtdy54BKwoYnuCraaTxbw0hIufp5x K30ZDwIiU6as1gdayxU+Ohf464LGs2LOPTSjKp4JUhQjUJbBgSc7OPkqFTK8z+Ga /o/NooI5vBhjzbpmtkzk+GfFpZdSKSSl2hQ+pm/gsG1S0AgJDKqyxFIashDGusnK Ci4jIqVO0zKMuttoHC7jmoD5CT1U0+wKftmY3VGoNTr37+UDOAWeXaKzUqgGgUWM pwUdxLtjdRRZvT/UAutAFSIxu0L6VKVRBO6o5gj2EVjcU6up+xjJjbv4WlngsAse hGxmDwgZxq923saQ1Ik9Px4KG2Jeb4EgxScg7ayiCJT9Losr2tA8N1XCwIf8R3pp ZHdHKnqvZGZWUTNc2Rd9DRJATErw6sYanL3F4wVMPDDw0EQ97owIkb7gibfxZR0U cBweMzlwj+DZgihJ6il6E6sUiDnluI4RgdxRXwvs4nb+6dQiZlzSWmhPlCH6uQie rCdeZp5Le2K3nK1WMCt1zZfvH7xCCuWMbMZh5ndeVG1P3W3/K7x0Ps1V0rfOWEcj PoRMT5Ty4X3glSLil9ZULPQbicVqwyS3LL4+xYC8EcDA1HZDPjhr+Gn3l1TN7vb/ fJgTyni0VVcIjPnpledvvaNje2ePpkyXdOZZBTIkXmd/2hFTd/hHjygqTi5P+6Ut 2ZKbvF8/AbjctJCEAh/ws/nxEQZtFpwF4WBJaLI7vmAuqBP+OiSXKSLbLI3S/Fco KqCDOvrC9o+dike1p8zoVNo82RAEHkvpyyEVJ0aoKz8Z8uZ9+hDqOLh8FNm3DsNz N1e1+8OUL1yHHT9TWnlE6soxq6NrFXPRJiTw0R3Ze/NQrgUDraINpISOjxflaSNV zpYIRjZznIBLoVyaObd42DlLjm7qH5udF3ln1zCgwU0CYnDAxtgbEx/mfy1jXyJk I5LghjyeR6f1pU4f768nMa0CU55mmLChRF2pcgb3F/11s0047Ud1DJTCqDyVA5p0 GIX/yug+Q7wGaRNVHK38SmnSyeF9u5sH8p3HWSPf++HeXiqPmHbU8cW/h/sSnZdg 52xuMNkSmvOrfDXEhdGWP/h4WmK0/gMbWyXAbTqhe+DVebjevl45kDUwDChIEnr2 lQzHf446HsUesYSi1+w94RN+i/fqGaXnw8ht8plJ+rTcXFgTLKfZD/E+z89fA24E z/bYXdejzSjG3vLX9wq9EjCtynE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F26692FCCDF3E2B5

http://decryptor.cc/F26692FCCDF3E2B5

Targets

    • Target

      3229A962B991674C860F617BBDECE645

    • Size

      116KB

    • MD5

      3229a962b991674c860f617bbdece645

    • SHA1

      5c4b231cfc58ce193a78419f9326efa2d2f0e6f6

    • SHA256

      1363b70d46c3af4d0794ecf650e3f50ceb3f81302e6059e42d94838e9ada1111

    • SHA512

      4da8a69c7109186f0bf51cb656a406de509ca8cb48ce05398b32e687468a79b595a3e68a7d9eeeabe4d4eb0ef68e86b6b43b59793c167870c457480e48fd9fa8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks