General

  • Target

    c12b58a1d90a2697cf14719d800c654f04ee2030233767daa676f5aa48cf6852

  • Size

    202KB

  • Sample

    201021-bbq96z8ene

  • MD5

    4661109d9590af6b4acefd19f40afff4

  • SHA1

    dc04eb196b7dbd7d5fef05e240838c5c80bfedcd

  • SHA256

    c12b58a1d90a2697cf14719d800c654f04ee2030233767daa676f5aa48cf6852

  • SHA512

    69103a0d0e2587be7d2273640b6494bae5a4bc655caad0dd1f06e05b7323582a357492b1b8bcc949459edb0c3b0b3f5ce9bc6e756e3d7bf1ca28b9fff3a80ea0

Malware Config

Extracted

Family

sodinokibi

C2

ecpmedia.vn

triactis.com

promalaga.es

siliconbeach-realestate.com

bigbaguettes.eu

web.ion.ag

spacecitysisters.org

abogadosaccidentetraficosevilla.es

blacksirius.de

sipstroysochi.ru

foryourhealth.live

schraven.de

mardenherefordshire-pc.gov.uk

pubweb.carnet.hr

joyeriaorindia.com

makeflowers.ru

seevilla-dr-sturm.at

podsosnami.ru

stupbratt.no

jsfg.com

Attributes
  • net

    false

  • pid

    $2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

Extracted

Path

C:\44p72-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 44p72. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6788183CF87295B8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6788183CF87295B8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 46UARzxKWdrVqe+qXUv50R/+lmUkPfTraSbMDmZYyR3pB6IJ6oPmhLvp4pvQBJ5w Q0dUka2y2h9a6TDfUqBoo/yOgATdsWMxjOLjbwY3DrdQwm987f32nf+zXs6rQ2QT 86qKbPkTKvniOMIdi49zZ5gUrFOi3lzO7drw007UfhKGF8BdCRJSeIV+SbNFpMT3 PjW351a544pEsFsnppx0J/QmA3OoTxR9hlu++rwbXw7JpDh6R1PS5teccDMB2Fmr u3X7Qoy53RXy/IUE2VMbJQ9XnpUt7TS1Lqwve2FrLjUVY0tfv4YStoNqOy2wQbs9 WWcoNBeNZSYJO8FYxN3FacGOlFO+QicrGgJ9JlW8aOsX7dI3pXLwyfS8kJP3Oxj6 ITWtX6TM2sbyUkJjiio7k7LJe7Y3HJ22R46onTy/GXECCtvpHGSkcnnQThsXYDuh d/9TAqU9XjsebhBbxUEa0QR41LDViMJT/tF8llkMNhIOlN6dlRXMmroEWsLR9c2S yZVwWM16wEp8y4l5xaWnaFZtKZGnIsmPKtKY2PX/nQIh2kuHphwTOVW718R2Xf6f Rra7QX34OmO3W0k2Bvp5M+cbKn+0YE8gTYm5x4YTo5lrkFDssE3dThttFs4/9lv8 BnWfNwWiU3zpxPOYV+galK8drBqPau4IDUxtE6TFc72SS7K543mh5VXS105Itljc U3kisZE2YB3igrjKr4uWWZRs0Y6C1sIVRGXv7sVzqAt/nr1yg/ayqA3q1CHUuokM Meu6rRUuAdKnx+9Nl3zHU1l88GWifhdy0Www5pV54wILpBxfyg03gpJueajlsLAL GPaDCUjZtMnALBGbfypp3bqRDXrztUuFBGdmIZiID1CvaV9kOMohPWfkMN9dh4eA lFbUUMkbnW9cJawhO2hk6MKazZQ0jzG2xTDN793jzz35nFKG3ewkU0J0flo2eZXJ f3Z+SlLpWPCSIeTk8yDrep5S1yezKyVHiJ+RIMOLOrFwZX5Z5kAXYxBHbYQj2Cv9 /Vt8SZP9kslpSZJ1gb2kBs4NBcgjZMsT9nstbP4atMyi9qVN7WomQ6QwfGBBPFLO NQd4hrFyyTLaM6XstEzchOjJnJI/H6q8kW34phMYeXhKgRgK7l/E9+B5CmlAYI2g z22En5LFg2IVQi/UYVFNHW1S0eGKc0iBBY2W4sYddqgFx6Cfp45nouCIkmYGapa/ kaLyMRUoI6PRAdWhR2i0HshvW8L+jjMhO1k2WBdt7oyRhmKVBe/HCNxDMaCIp5sG nX2BZJPitFgmnpRfrCU= Extension name: 44p72 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6788183CF87295B8

http://decryptor.cc/6788183CF87295B8

Targets

    • Target

      c12b58a1d90a2697cf14719d800c654f04ee2030233767daa676f5aa48cf6852

    • Size

      202KB

    • MD5

      4661109d9590af6b4acefd19f40afff4

    • SHA1

      dc04eb196b7dbd7d5fef05e240838c5c80bfedcd

    • SHA256

      c12b58a1d90a2697cf14719d800c654f04ee2030233767daa676f5aa48cf6852

    • SHA512

      69103a0d0e2587be7d2273640b6494bae5a4bc655caad0dd1f06e05b7323582a357492b1b8bcc949459edb0c3b0b3f5ce9bc6e756e3d7bf1ca28b9fff3a80ea0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks