General

  • Target

    2e83e8c0dfc380cf60a217b10b6e208e71e35e16ceea6a6f9005904519383426

  • Size

    116KB

  • Sample

    201020-9cgh1ergkx

  • MD5

    2174bbe764a989e7e0b0e1b01aae240a

  • SHA1

    4e8b23ba93fd8ca5bc108470207dafe03881c031

  • SHA256

    2e83e8c0dfc380cf60a217b10b6e208e71e35e16ceea6a6f9005904519383426

  • SHA512

    2978f34e7d5474257f3fcea74a04ac8c874aa1e84ee8b570ae5da262c5972cc63c18ae7c2a3f639a173116f1ea3a8fe6c46ce8c9f3fbad62ad4752be8e90132b

Malware Config

Extracted

Path

C:\3r974v-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3r974v. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/117?s=ab401dfaff50a245d377bd31aa4d89ea [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0B8805A7B6C95AF5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0B8805A7B6C95AF5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: d+hSvhEKLqJCSDpAF5VJqM9+AGV/ZRf5iDF95FuzxtX/vA/It8vgM15p0ymJnowq rT/173yHwqsB+chclL0rWSRZjipO592ukL7KNAicELTjSjI2ix4upunGbBD/ATo5 i0vZm9q+1s9+SxMRdoXxC8Wa817442HXkTVz3QFqV13d14mAfh4U2q9QIja3RGGI K7muz0fdw+zUsTXCyFOD56yz6akkgHkTMxwXbnJYozpJBdIO+pDXA/5k8saqFNgP 6UWYD5KE99TJTwFHehtPF1HNp2Cch2FMG6rOUV/4SMH6uwq1uw030wL0gdNdZE+U LqAla8lMLqD5GyZOXbGVpx339RaU6r0WKiiU4Vm4UyxTCuuJBVdhFOd0BAsTjsXe LJ9lWckLpSfERLstEm1BeZGjs6F4iaBbaXU3Kab4XQ9E2SNOX9YeiLLXaVuzRFNA pIThOTXrwk/eATGacTkR7hgIQEWVTT1/AQ3qDkYlSd4QL2SNRm+S02oWJqmohuoZ Ti6aUUQp8hN6LjWHXLukIMpO3a2jWwo3vLtbl9xEWkTGOEaRvpgPyI03rTxyQJjM KW8DoFkR0Lr64duuSTBcS10+/DLnLjoLshPprAED+Q+13QAN7tKeULzax4A8uxvY SgtWL8q/O5aeUQ5754fBG39zDOZXV18Zcm4Ty1xYv057ZeEvnijGKH9sneqrkoFa lrONmqdl304LySH76o98jJ3F81h5l+YtT+2DgnNGwD/EpeHrHQfzFHAAv7OGxMAf IvlDcI8KmsU0O4lPASOHFqnu+tC74nE1Gv8ImRih6VUtz7tAh+ETwzdqyIhL/8dv HKDx/ehDM5uEJJBbm0MpzJQOfb3cWG8LU5pDaNR2W+7SfxIk/q24v1MiaDx2Jyce d73VXGBNAOJmL+8tQAkie6WaVuQ/hXUQDd2TXVnFkglUiwlNwY9IHGnJSgjngSoc owCWPlHlJZ/kYXpRxAMtSE4VDHZnMiM5Ub3Kr+cxhLDWSM2SJrWyaDxXHX17G/ax P4dZqYg6+siAtsI+rJwqllVA9Ti2iCgbHN2lefTOb12J7kmyorsGA6Nji7SNGIP3 nAEeZ+h8h2AKjQzlfUwBpSOBNYMNT0y4PTXEGDGFxfjJ+e3dcAUHWU23e87OEpBO hvWpjysdwA6n2A62RJEqMD4r/Dqqhlzq/ZRsupdA1zJk/5B1fRUXeq6W/P4UnXHY xziOz43APM8G2d8fYO01ycgtSWiAWg7R9w21B7jAfmJgWdFckaVyyvmS9mpzN92u kv8ogiy56E1JpdcIEHvdlg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0B8805A7B6C95AF5

http://decryptor.cc/0B8805A7B6C95AF5

Targets

    • Target

      2e83e8c0dfc380cf60a217b10b6e208e71e35e16ceea6a6f9005904519383426

    • Size

      116KB

    • MD5

      2174bbe764a989e7e0b0e1b01aae240a

    • SHA1

      4e8b23ba93fd8ca5bc108470207dafe03881c031

    • SHA256

      2e83e8c0dfc380cf60a217b10b6e208e71e35e16ceea6a6f9005904519383426

    • SHA512

      2978f34e7d5474257f3fcea74a04ac8c874aa1e84ee8b570ae5da262c5972cc63c18ae7c2a3f639a173116f1ea3a8fe6c46ce8c9f3fbad62ad4752be8e90132b

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks