General

  • Target

    3f196480b636b4570769879a5e3a835bda27dcf2eb15008494a3ab50759418e7

  • Size

    391KB

  • Sample

    201021-3naslvb7tj

  • MD5

    4c9f8e92d34a77b1027e22981422b67d

  • SHA1

    620b653b10b51e19c730d69450843a818a37628d

  • SHA256

    3f196480b636b4570769879a5e3a835bda27dcf2eb15008494a3ab50759418e7

  • SHA512

    97f617f33e1b83367423ebd0204b511490a7aecb7ae94dff7c67d8db062eabfa1b061bb4b1efd62ba7b5fbacbeb5d797f209e80090797ff29f097a6f900a0dcb

Malware Config

Extracted

Family

sodinokibi

C2

ecpmedia.vn

triactis.com

promalaga.es

siliconbeach-realestate.com

bigbaguettes.eu

web.ion.ag

spacecitysisters.org

abogadosaccidentetraficosevilla.es

blacksirius.de

sipstroysochi.ru

foryourhealth.live

schraven.de

mardenherefordshire-pc.gov.uk

pubweb.carnet.hr

joyeriaorindia.com

makeflowers.ru

seevilla-dr-sturm.at

podsosnami.ru

stupbratt.no

jsfg.com

Attributes
  • net

    false

  • pid

    $2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

Extracted

Path

C:\h617x752-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion h617x752. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4C2EAE27540F72FC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/4C2EAE27540F72FC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: nM+PmcUXEHAO5FfSkgIauF3dxt2gMwnKnE3uNblSnSgdx010OrYn9j1V4GMAxArS umAHNq4FWIfS+3UzBNHf5BxaFczdDMqFydSC+2Ezx25cLDjLUy985o1ZRN8E6MbO oLX8Ta490Q7iet12N36D4xb+IEkdCyRrT6ahUa12m30TJgqfJGnuAR/qsykk2vlC 0pIz8D/EFjNYdF615W0BQewSNMFdbr+jUniqCpheoFxIqxqgefD5fww+HtHu48EN 2kZsjMRaW5iXb3/gihlbxM8t3GRdolhKIas9b7U0460dNgqJegTFJcgIQTIPiiFn 8Ge5z3luVM3KzHm+tVOoZv2NTJv0aILsX4AxprPcn83BL8tCPxvlt7xpsN/gIwBC PFGqL7YBdiB+X9HCorTP9CFd7S1TU1DpplkxjINchgbvhXaGNsqHyV5F426qEQuo sIX0Mtmjhp/uUgtqlYBMdSLxRSxnkH1bWPdVRmyoZN8t4/OpUHcWcVs7ZuyUg1tl Eg81ZhjrUKTu2R/WakkrUb7a7euBXFQcJhlIlcCPM2CwbStVYbBGeAasmGUxQv6w 8+8RBhJowNzltVkRmFbkF1Yyj3FCkse3U4HYmLxrfgQJ5vKEgeaJceWH32nV0zPt vtbGBkki2f9xZ8tLbCDscZw6xUtFttoRrmtdij3+fwyBEdkBEZOL9tghi2WIXGCT eOyigSzopI7WRA9dHr4iOUWs39x8OY/745Kj+IKS5sPyhzGoUjxotOYjzOo2LgYq YvRCZvQpkUlhTiYoBKgAbGdl+XrGR4aJz2rhtox84FiG+nz5WNGrn3ecAYORzVsm urP9xDLEgkYPEjPK45SB1fvm1n8RDeZfCJcP4LKpzEKW4XlCxAkTsYdny4cipfUk /E+8Dvb2T7TdFqgIzR+oaLVjBOYL4dGgCiNxz3SCnbdoYB6uAYd8WBT+R7A/PTAs DnsWIt4SkKRNqIkoyFIwbSDv4IE1PZFdKMpDkjiYdRntuUxkSTdp1dC/NxNZE7Lu NWwJsiMNH0CI9vbi2YZpLeZ/TEK4c33VZg7we7EeLjphJUX6UwjVrTZ9gwIGJnBx IZvXGBdvm8hdMr6cpj5hzISmHs+AbcbINJK1uV87axXyWpkrJl1vgBJObOKrZ2Is 9X1oxyRBRxcCYSXTpFU9mLsG/CHQJqdnjHnVQNcq5NPfw1c9MZv6Q0bGr3Vp2/cL qAAAGNjNcYtFquKumYWQsw1HrBDDydcG3eqW/J55MY3DJHWNcRzogTU/WtoweS5E WME+PzNJI7pTpS9Ch+wuJRZT17I= Extension name: h617x752 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4C2EAE27540F72FC

http://decryptor.cc/4C2EAE27540F72FC

Targets

    • Target

      3f196480b636b4570769879a5e3a835bda27dcf2eb15008494a3ab50759418e7

    • Size

      391KB

    • MD5

      4c9f8e92d34a77b1027e22981422b67d

    • SHA1

      620b653b10b51e19c730d69450843a818a37628d

    • SHA256

      3f196480b636b4570769879a5e3a835bda27dcf2eb15008494a3ab50759418e7

    • SHA512

      97f617f33e1b83367423ebd0204b511490a7aecb7ae94dff7c67d8db062eabfa1b061bb4b1efd62ba7b5fbacbeb5d797f209e80090797ff29f097a6f900a0dcb

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks