General

  • Target

    LbYesiVe.exe

  • Size

    116KB

  • Sample

    201003-davk8gcy6j

  • MD5

    284281286455371cf12b69ad76034d08

  • SHA1

    9cee17cf7463f677555ccbd1cc2e574ea7e74a31

  • SHA256

    8c32012baa74c8ee1bf676094f688505eae215317cc38c0e28a518e5a9d0b70b

  • SHA512

    e1ac523859e197594c89937a88d9c556041a5965e0a4b2f52fb602a0dee2ab990c00a1912e40d115c4164016a43a2d7b24a8a07f095dbee51393c113f5c04918

Malware Config

Extracted

Path

C:\d56m7cc0r-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d56m7cc0r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/24120883B193C4BE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/24120883B193C4BE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MeOqFPFZOHsCotgFbTln6lSwsS+jovpPtT9kdsQUnB7z09AYq1FO8AafQODgEm3F WrPZBGJiFSCbJm6S+LM/APpmZn4hszo4b7m53ewrVD9L2vFcjI80MeEMcdJkLGjd hMnS0UmBppE5fLYS3EdeS3Aw6ROgxYpynbJBW+UdVlwYfcXEGN6HsFWATLwlUoI3 emsSIkV9V3rJpteafPwLvHpFry5RHXMnvMA3Bwvvc/M0SW89Eczp5D61YKz4CqHy 3Rx/We7+eO3xOe1fl3qftZA6XSxq7AO7at7CEiJgTum1uqb+WUpL7Q19NOFhqFnT 9qt8rzi0aKlQGgfYbnvjAoyvzJ+0QQKvcPT5qUgGheY4EhJYryxLqg3PMk6pjwby bvkBpNk9Hh8xG+B1wS/e5xIHu/mLPFUfpUoyWmTl35xtexSgGD0ZUAEMqk1P/vBL BX57GcT0e0AsS0hZ/t78hgt1V3yJ546uEeaoKEOQMP3GM8kD9bulMnpF1WHwftdh w3RjK0TAQwY9OVH34bBZLC2S1sWoPMs88vqsQvBWPhUjduTYloTZnQ599VM4QS2x O0NpJ/mU8svq6Wnaj3DokPrT0XlYhTjWcsOSzzQCdNL5WfWKJJ2TR2OyihQQQW49 Kq/svPYc1WioLjnCBl6+tIbQbd+eF7Qf3pxogAI96pL0tbFtdv3sv7Wp/p1dpfb6 7aloTQnVXx9epcF/1ZaVCOYoYX/Vs2YjI+c2AEqns1MW6R/ZVm/VkLvWDTEYedr7 MSZtITtoGJtXFT4AYe70th8IYfAMXglBLsQNZpXs2ox5ltCZjWpWAu/faZmz53VC K3/ryCCc30vACqGnGjUBa/ZcMjQiq94Hz7fW1Pr6iO5fnebVc+B2g30M+f28jTI9 uEsVuPEqucLOfcVo8JmRvCKqQ6YMNNzL9kV7wVjzAVtVqZNXg+i7wUUfG1dH8nL5 VMsszOtNLzXGQTmsXt8zZiAQPsGwJeV6SmbTuRi6AjUmzdquoSnFEtEeR5gSpt8h TNcpCz1lc5Ju3EmN5LwHg1/HGPEYHZqsEpgMepTmlQZfakHXujRPvRzobqeNBZNK sJ4iN1j7qcrT+Ht06hM7CPUrPb1QxBdSMIYzVlpNb1CcwsMrFnXl6qMM4LcwZb4Y 8y6yM7DguB1SzXUxMVaYfL6NiFVE0D4pDXfzoA12zM7OncRiaHzc5MTywfs5XAFP jGDn98SlSVl1npDxFxKHG3cmbtp2ff+bwI+RB4wtLGDZyTfEpAXoY6jIySz+ycwG NmpZo9G4mBC8p9DreGlEsfac3VVDZQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/24120883B193C4BE

http://decryptor.cc/24120883B193C4BE

Targets

    • Target

      LbYesiVe.exe

    • Size

      116KB

    • MD5

      284281286455371cf12b69ad76034d08

    • SHA1

      9cee17cf7463f677555ccbd1cc2e574ea7e74a31

    • SHA256

      8c32012baa74c8ee1bf676094f688505eae215317cc38c0e28a518e5a9d0b70b

    • SHA512

      e1ac523859e197594c89937a88d9c556041a5965e0a4b2f52fb602a0dee2ab990c00a1912e40d115c4164016a43a2d7b24a8a07f095dbee51393c113f5c04918

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks