General

  • Target

    390219bc85958cafb5a6c8e98a2614265ebb087a4df631aa850b3edc7718a4ab

  • Size

    391KB

  • Sample

    201021-4dby6c79c6

  • MD5

    3a0145544a2e2f71ac9348487fabe12b

  • SHA1

    f548bcc66e17267c9faad3c00e6a25cbeeac2190

  • SHA256

    390219bc85958cafb5a6c8e98a2614265ebb087a4df631aa850b3edc7718a4ab

  • SHA512

    bc9e50c30afbd577c6e81a8ea400ddf2fd29c07b0f9cd7bcdf691d13cebff90f0490df57990c90a7d04e6b979fb572e686c5291a1a2718464d13025d8fcff965

Malware Config

Extracted

Family

sodinokibi

C2

ecpmedia.vn

triactis.com

promalaga.es

siliconbeach-realestate.com

bigbaguettes.eu

web.ion.ag

spacecitysisters.org

abogadosaccidentetraficosevilla.es

blacksirius.de

sipstroysochi.ru

foryourhealth.live

schraven.de

mardenherefordshire-pc.gov.uk

pubweb.carnet.hr

joyeriaorindia.com

makeflowers.ru

seevilla-dr-sturm.at

podsosnami.ru

stupbratt.no

jsfg.com

Attributes
  • net

    false

  • pid

    $2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

Extracted

Path

C:\o1d4v6u2v-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion o1d4v6u2v. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F49CFBC9B016ED72 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F49CFBC9B016ED72 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ACjEpRAVeBqKrsreBbKxV00Tx3/P2QFdoutZanmXejrQCMbAk/hBISDlOZv35ini Ak3gFovhx2KWaa6qQ1UW+qOU1Ifip/XBdbsa9ikT2vnMVoeI6tBejDWaPvLriuNv +YU+3k8Qs9r38uk6+fFsXDBb4Fd905tsJ34YZfkSVE19TZTiU+lfyt1eiN7Eg68F 2ML4g3Nn6VWSR8cPcEsoVmyCHKxMdsfWn2h9nDtUnEIeiMb1Wd0jf6ZYn2TRlEfm QG798ZWD3JQb1yjHqXdVT2fHLmi/rWYZkLHfVGheL7gqdejrpHsJZl9oOu2xI2hW pVsmBVeJgEYmORI6hu9k7E6cc/5bFjqOtdfpQ1PaEPDQvhagLlYmfZKgFrnLhQOP eCr974CJNR9V6M9i606bMSgRcK94JNs68UsOGBoKxx/uPkbz8jT9O+pvQLWNm7xZ jwTTfR49+r2chY7vzNspXwr45x3nhKgntYCmrudMbZsHlkJmJouFydQcFAGZDUOY 4ZLn+P53BDpA6xnhn1fg+XcCv/Rdk423mBkXJkyNPhmLzRYzdPn5GrQL8fGxAN1r FFzOkBq2k9neHjERy5qSgHgyRidCqmnE+dFgB6cukiV37bObyQYXMs5wQl7RZWTk Dh3pZgZp0vS0CxO+QAuMpM6H2ljZ0iF+w+lO9ppFxvxqhL8k11PYIGeOwUrksGDa QiNfbOUhvt38ZwZeU2oeqczB6ZOTJ+aPw6qH8wwtefTf8najax+sNiLZCT0mOAnn RwjKUwMI5+hAAzG0GW7Sf86pOBVM3V64csaTJ+DP2xlmyK6EOpGh8YLjxBbuaXHS 4WGJke6zTcGoe9RaXHCCQkdGhC/zgOTer1rOnlhKorGIp1VmCByAAUaKm5veS1Gp F06IoAF6UCsa67NmX+G0d7BNdz4qZbPm5Tk1gw/2uBlaPG3eGE7T878SYiw1vc/q drXVTxwCQj0d050hOcYH2Pqr/lnY4aiZoB4ylPj4RhuSN/3xK1nNVOKHGi56Hewi ICmzom4A/oWP7JnLXEIjkEuUb3z+HSbdd6WlX6KWh/C7e2rs6bIMuPJ7NQ6BTDav osfw0dUQvP66Pwirx8xunowo7UPNFv7HQK8mINp0vZOfjZi3OZFCGVei1aSrT+qh 0wLFOV7ybZm0MTRW73KJVRVhrE5sWSHz+/cpAVQbmp+VGkrURNg5CyoBRP5QCvIs 1H0lMbzd9y+roPFOrcnwFNZzqpNlgoWraxlpxSX0dGOR3yb9o0QCKiJj5N9hc/oI ECGBBSZujWaBlwfI1Uu87ECHuOroJA== Extension name: o1d4v6u2v ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F49CFBC9B016ED72

http://decryptor.cc/F49CFBC9B016ED72

Targets

    • Target

      390219bc85958cafb5a6c8e98a2614265ebb087a4df631aa850b3edc7718a4ab

    • Size

      391KB

    • MD5

      3a0145544a2e2f71ac9348487fabe12b

    • SHA1

      f548bcc66e17267c9faad3c00e6a25cbeeac2190

    • SHA256

      390219bc85958cafb5a6c8e98a2614265ebb087a4df631aa850b3edc7718a4ab

    • SHA512

      bc9e50c30afbd577c6e81a8ea400ddf2fd29c07b0f9cd7bcdf691d13cebff90f0490df57990c90a7d04e6b979fb572e686c5291a1a2718464d13025d8fcff965

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks