General

  • Target

    1999399efdda1850f9dee3343e678ef280b419198ee008bfe6c7c573744c6e57

  • Size

    174KB

  • Sample

    201020-zxv7zyvyfx

  • MD5

    5eeea21a8027896614c7d31f894fcb85

  • SHA1

    47b3c03fab5709a4f91af5d69ee5bfe986f4f6c0

  • SHA256

    1999399efdda1850f9dee3343e678ef280b419198ee008bfe6c7c573744c6e57

  • SHA512

    56fff7d3021ce70d9b5b7912d0c062d026050b8bd3ae7dcb2f1ef75b80ca8c5735eb2b4258711f9acedf632ee9808acd3181a9e6430a6eaf6b9289b9f85d5fa1

Malware Config

Extracted

Family

sodinokibi

C2

ecpmedia.vn

triactis.com

promalaga.es

siliconbeach-realestate.com

bigbaguettes.eu

web.ion.ag

spacecitysisters.org

abogadosaccidentetraficosevilla.es

blacksirius.de

sipstroysochi.ru

foryourhealth.live

schraven.de

mardenherefordshire-pc.gov.uk

pubweb.carnet.hr

joyeriaorindia.com

makeflowers.ru

seevilla-dr-sturm.at

podsosnami.ru

stupbratt.no

jsfg.com

Attributes
  • net

    false

  • pid

    $2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

Extracted

Path

C:\u8zzfx05-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion u8zzfx05. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/429144C4557A2285 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/429144C4557A2285 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: SJlwen8aeun3GdW81aob1m7wpnRtdE1eMlR/o9s/bBhCYSJZaj2FV9wcrPED8JNb cRwayljGIgQbz6TDhCyJ1SCR2CDWTLWd1EeDp6a6jxMqa/o3mhm3/nV+POq6dsz2 nyCtqJbOecyCkJXyNkK9HYHiYOSe7O6wvcHbAynuIXmODpO9mQtvxfO2hT9rhFf0 IHIB+CK0dF1JV8WXLN9381l6nmMH0SAcVIzeMez+T2GjMwCcDEjt8nuHZcjmlrGv F2f9hSlq9+2HrJtxa6htbOE09q7MDqb5+QjXyIR1n4Wl1wWwGG2rgxHXL0o2IyDc /laHjC6tcpdlbA/sG7Yl+1APXqiW0maVdB3sGTHGhXVIZ4UnQDaAqq2wQRvUSx7a jzZbVCQEGAo7mGbn9zucw+wSpYqvBrrMAmkeqgwB8l625j6dpt3Ib3WCfDRRVUFD znKxNTihZeceJpkc8v6aHcx4r2Hroqs1NKB7HnlBbiiV/RnYBoEjs51rKHI9/1G9 U7uaY3/YE8eDCu1ScaSvT3odnG96lNMgKUQPT7kqkazLdIz7WyqDLZqJFQ7esjUH 91kXT5jxNR/vUS/9oLLhrXbopGr5IHvIalJqzrqqTOdKzF4Y1x0VbXs682FLcltX V0Q96x/Efc/jPOGJD0uj9wi7wXeFluOSTLGlPbufRB+/G6dNFwwfGKkcx/rADv14 Zj05MVEMN+tFllXZvGR829shZPgmf8W1JnWqQehPI81TDo1fDtis3/PJcD1X6Txk z9GdLt9Qvhh/S+0HgBsmw9jYjhYAAEhatTA1GhBqifZW2qQcB+L/vU1XMH0CtnTf yLAT8NZOZtR6SnEli3UeNBlme7m6pY2rvLhUsLFRI19owwycAkCgNYboanJSa8G5 v44X681IG++qwHoHqZDeBWl2/A5VdP5T+/qI+DImvRo/0VDjye/i39d22lu7qNin zxYC1ULG9QhmKti0Wzdbeue1RP8yaPSR5aZN992YsaKhWZnKD/ebsoI2Qw7dFmD2 VignpiUpJ8EoMS+pW41vBzdKAr3Gi38+Xm7c1S+8Yq8beibeznvUABuAGZkKnW0N rhswkLQynMHh+Xt1xPWeF/YRmGhoyQ0CYivZfCbOoytzZnf7YY7ttJsEFfBjpf5L SEZny+W4cBu+fatOoyHksX4vI4wcmf3Iapq7YdpFo1jwbaFXlzXPgGJ9H/keCtoK uz4x6FZ0etTK4eIuwkjpHjbG+RAQ6FreQCIaI40PMf1hxz7S7s8lCK7C2MGW85cW 1plszb431YeoDj6p93vcQgfla0o= Extension name: u8zzfx05 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/429144C4557A2285

http://decryptor.cc/429144C4557A2285

Targets

    • Target

      1999399efdda1850f9dee3343e678ef280b419198ee008bfe6c7c573744c6e57

    • Size

      174KB

    • MD5

      5eeea21a8027896614c7d31f894fcb85

    • SHA1

      47b3c03fab5709a4f91af5d69ee5bfe986f4f6c0

    • SHA256

      1999399efdda1850f9dee3343e678ef280b419198ee008bfe6c7c573744c6e57

    • SHA512

      56fff7d3021ce70d9b5b7912d0c062d026050b8bd3ae7dcb2f1ef75b80ca8c5735eb2b4258711f9acedf632ee9808acd3181a9e6430a6eaf6b9289b9f85d5fa1

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks