General

  • Target

    e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923

  • Size

    115KB

  • Sample

    201020-n1981nrlsx

  • MD5

    0800618cde0d124c6616ef384fbe1434

  • SHA1

    9404f15917b9a216242063d1b7759d891bf11314

  • SHA256

    e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923

  • SHA512

    0dbedc86f146716a394af812e63e6b721c37cf1f49da07ac35d2106495b19a5f473344ab90a026e84441c4d0741c3b21ba1815616886ce692d6b6f03b0a45703

Malware Config

Extracted

Family

sodinokibi

C2

arteservicefabbro.com

lichencafe.com

nokesvilledentistry.com

fatfreezingmachines.com

iphoneszervizbudapest.hu

kmbshipping.co.uk

readberserk.com

blog.solutionsarchitect.guru

knowledgemuseumbd.com

vancouver-print.ca

ctrler.cn

sarbatkhalsafoundation.org

myhealth.net.au

aodaichandung.com

easytrans.com.au

hvccfloorcare.com

filmstreamingvfcomplet.be

myhostcloud.com

morawe-krueger.de

noskierrenteria.com

Attributes
  • net

    false

  • pid

    $2a$10$4ijuoKXzZS84.hB0I8Zd/uonfprFslHO.9PY/zlYKxjCkXRlyDZNu

  • ransom_oneliner

    All of your files are encrypted! Find how to decrypt {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3476

Extracted

Path

C:\How to decrypt gg5a8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension gg5a8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE0D0DD8C82AA38D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DE0D0DD8C82AA38D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: AlrYNXLghv+DW2gsQK7gyyNCueQqNkGpuwOfBcilgnmTPR4TxXNrnauMGG+Ah/vB Lr2TLOXTOwM1tVtlGWDcpKmb/ZCZ0b49Bn+AM/Z7B8HhyqqeCdL75gVA4M37sWtV XTRDNWWEyMgv+e3jsXTdGL3X6Jag6vpwnZpVwlF7jjbziQaJYW4NMRHtIgaWmpp6 t27/DSsVVp60k6YS9kPYV1yXUgYXF+ehwdiytqMYYYTTrXm3ClhtSujolm9dARrq U7ehLyRuLW3pshu8naBQ9iOZ0kAOZcu/bT4oTYKgnFKjkyI45Oq/Ipn9zxzYyTdF z9EfAUedEq0khdbV39aNeMcwvheruuR8EsNn0cVdIj59OPPJ9ucGuRQ97csJomrS Qh5dRrhUbGrQzSSDf20T4GtL37l9Z3FxahXWEYPMlX8gS38AEd1JFCy+FoPegttY 1hHpK65NPsPaYvmelXf573TqYgudDGP/SFbz2ZJhBtEjKu6Oug0mMhW39SKXn7cW mF1XsCgRl+MUoYOg00acwybuLO5CN2VehqAM2XFpH2R4d1B0JSK3hfujbj8AM+lS ZWJdYdVW+ueGMefs/7UruSX+Rr9jrkWcJtJ4fjFECcYx5Sbgj1WwMGaxDqAyp5MO Hlq0NE+n8XsZGEPKF5pE/daX+c8JwSxbp3wHYGtcCxFjuecjF5ukOB68Gmmyf7Pi 9VuE+gb74Z1zasnr37A05R7IKSSoEPjzbo7cyflGK7pXe3ZeseuBGoqHNyF/Q0PD Sb+dYSMBiiORXLN/jMGPjigMJ1LupueAe5eZG7upl9M2jLUQGeV6YPXavYybEVQI WUh54ICT45Q7Qxum4YFhajkzS32qNVmj4YXeCnoxWaTfQmdLKwDJdsUg4a1Xjw/c P4ngeDgx5L+QQyVkDiy0M1DiocrjLzEefPrFDOv4xA0UlJK7KYR7emOrGm0Ie8gs wa5Dx5VVgVBn6fzCC5OKK/TT360D5c8h4zkIz29TNoh4qG5hteaK+Bht7q5HsMrY noPUCUGdmr+EjMegxYpbRavlJ81GPD9mZSi5NSrJqwhikArFa1X3+6riZeq2ocpR fS7Ka9nME4Zz6tnBePzhyjHt+U2lPmg660awCfVaF2Z2uHyrVLZch1d2QG+h4G/i DTpk3r4qOBLfhTS610kswqnAA7XqKs68QwPgqYemrVCZIsRK6NzHdg9cN38bmL+b Snx3lWEYR/BJyGSZucbzF+jFaIeRGX3dhVpwNOi3XkbYspmcGi1Q4MQjC3jK2I4I VfzGYN4PTGrgBlc6rUg= Extension name: gg5a8 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE0D0DD8C82AA38D

http://decryptor.cc/DE0D0DD8C82AA38D

Targets

    • Target

      e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923

    • Size

      115KB

    • MD5

      0800618cde0d124c6616ef384fbe1434

    • SHA1

      9404f15917b9a216242063d1b7759d891bf11314

    • SHA256

      e9e5459e32521a8ca1c075a96d3358337919321f5d149fe3a8cc5f6f57b33923

    • SHA512

      0dbedc86f146716a394af812e63e6b721c37cf1f49da07ac35d2106495b19a5f473344ab90a026e84441c4d0741c3b21ba1815616886ce692d6b6f03b0a45703

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks