General

  • Target

    as.exe

  • Size

    192KB

  • Sample

    201106-r26chye4dx

  • MD5

    beed14bc183ad523b94ef6ac2b270b08

  • SHA1

    4ea45e0d8a4d50182063cc97c8a86d579f3adf05

  • SHA256

    b10d9a62edb6081aa9f7fc865554064bb212555392b1181dc40040e12927f988

  • SHA512

    da74c44e21e120af26074fb6493a35067f037cc633e630b415d9b6947c9dc58e354fbb33afc87f733da8cd4d1f8ca66081df0e96d249ffb1c2ba8142c9317196

Malware Config

Extracted

Path

C:\z8670ejqk3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension z8670ejqk3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0228824883A2F7E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E0228824883A2F7E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hhghYvWFLFzOXyFRga8DeMqQ7N9cx7Nj7qhg/q4RHGtCDEaXhegeFjj3nQ1vQERJ 5Xx305mAtWpFZXmwl4ehISObLiRa9vnHm4jUnZnVTMgNZsh1mJaDaYMriGK1ZBg0 bHPFUo+wexsW2gjfiezZGjP1HIv30YrYP01c8qNECsYVK12tCz2htj2jyjUIn15X n8c86cvUMCS2d7HZOu4cc30D9z1PvM4eNn+GegT7O1rdk3JuRWE428H+jNqelVPe kMpoWuWKYbT7s9Y/25yCHBX0peKS68gri69QcOT5NY1isf8NaWzsQHDKToZuA9ba HhyXeErwbBHkx+ay+54PCg03RtSGkKcV/BcNYsc3Lgxq8f4ZbZ8OR1YwgpjL3IYU B6/bvdI37OMiee4Dr+gtQZieQcb0tpLvyKXnFLWsxaAxfzZAOy2uYe9sRrqsjwhG MgG9aw4Yy1Gu5Fp4lU4C8n0s8eA+Uq/511Sz1F/JHnO553GT9hIO1W5Dy7rh5Tp6 jybt1Tk1aM4odESHIHjFu73LgMT+/TEoUqxVplCNuDXGKmZHDuZzG46DrSzxT60l YX+3jIhRL+SLJFXkjyA3RaGlZYVMxbxjxFzOfNTFiIFaNmlDG4kvWy7fiqlHUqqh 08pQvLou61npqj34knaMPO4oKwkCwPOVGNRfbRIO8QtJe12MdLV/Z9+LFXgE/wey EiI8ml1yCTLyLH3QiWtPmAibjw72gA4C3Bhh8Z7/NxpFGzavASe9xNzFh7g4KThS RMnJ8vtq5ERqLMHKdJCzJ3Ws9C2HxwPcLhwghPTeXb5OljCWlEGMSF1zxdnsIzuV oE+5NfYqZQEmC0N5ywR7JVxZlk7ZaKEqiXa5kibT8fhVEUOysANPxD100BhvCLcA p8HUzadKPVyYcQCs5YrlL+gkQqvX1pyapsEcT8ae61DZioN3KmHNFs2XvTGbgruo O2JnamxjEEUpkOqt2trBpHimaHq5gJiOEcMbTuh6zs+n9F5X3uxCCp/d4MBaUZLn DP3IVHjwUOrcnoYy87N8pbubCjwVK3JTSOLwcTAtTBky13YrnjnfxzNBAsW5ctsj q2/oqDL9OGPGTHgXRzE2lTZ4RQKrI9GsbAE+m5Dgkdg2+iojEvIccQcIrQSwqI8s HM81dfuSgJpJbgcV1wD1kamErza3/wogXi2LWUn4tyRSe/fwuYUMngS/WfJ5Lki1 WaG06P2XB3LdjkIdVO8V9UGSFr4QAdf4MAuRKo2kZGHngQXUtKmn0TWIXwbM6NCW L9Cf2Be/KWQZU0yObQ044BgkWxnOFHpqcfptjYx+hPj81zIArNJWyw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0228824883A2F7E

http://decryptor.cc/E0228824883A2F7E

Extracted

Path

C:\11tt7id9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 11tt7id9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/61773AFBBE4DF929 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/61773AFBBE4DF929 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: d5VViLFSZ4A8FfZUaqlqm92QOkFNk2NbShAyh7kVNX9HE0yg3f9fdJb47XnjbwFP zyfDlan/FaHvIcudx834TqRHvwN5WKUuuQF5BP+XfF/4fL9CcRcwRnzySfOjbpf3 X30tKfQ5Vf0qqziUCXX5DDG+5QjUoC4AHR2kXwsoQNRN7rntVf6SzDP8uRIupJAy fcszwMApduon6VAEqORNFRy6T336oqP9JPJJgOtE+sBqXM7dBNvi85SCGgOYnWxl A4ixQq75YrWOPahWenzlVi3kTCu2yG6bS1vvmrhepdyiAfv6buzYf0gEsPxAcG3n 3AYqd8as/WpLVOmuuK1kPPMvkAuqiJ3X0aNGcFR9uEiQ+Yse2ec4X/mYgPL9ydFV RaD6+BMohtqsIIwQdkeftTo6mKZb0NB+Ofxsx/cZJdZJo05Qo17ajCgDuJWW1BDy 3nvbFAuUfx+B8raASeaUUVDA7Tz+Ph0jK0B9gzkm6/btcNJKq06RaBZWuoupeXKs xihOZDJfmUZxEZmwBaPTYIc/rwK+VEcq7p2csbg4dI2IZKvlU2DWnGZ95TAagWhz DFhbkQbXyyMDyctmLcSrbws6Q2hZDqGKRHk+lejJ6ta1Mxr/rO20RPZKqsHLtv3F ry4uSxzX5ow6xqGkD0MMvvo31ozqGMEfybgoFs42jrEBKzlMkdUEUYLo1HM0dC/3 MGJj7Bjhe87wooZRWamXg+dQBtzUjSmm4Ct+1an5Xk3mYL/oesGMH1JMFiRWrglu Bnv5b2XSIrSLvvv/dnjFus0ksM48ZVSH0eoXxcWa9XFyNG8ALVFSrtQlpzdLl3kC 4bJMy7XOakiyj0ZqTXj8McJ+8SASLRdSQG5vimQVZ09Ug5rAOtCrA1WNWrBZp4Xa FGpgaXnN9t41fP9s0Kbvg5BKVz97jugsEsYhfjN/EKNd/62TEpfbR1uwoGQ7+xy1 pSh3FOvtBJmvF0B94LuyGi/a64kfieiAGmCwCUIbk4JDTmyMRYP8NRM4VwTSQEYv bC4PmItuHU/nOJPNgbMI0waOd+Y1DXA2uG2fk1eqsUOdI+0SKbTWmIJn7rOuGuNJ B9Z2HkbA/5F5sjIziRs5v+tN+JtLt6AXhyfE7bCyb6TucOk6eP7GeO4oNeNx3gpy ednU73vOw6XOiVI43u/zNL7WhLmsE0ESPN9sUAlVOAHmCKq1qtF2mEmvywo/laM+ wNqfSNA9dncencEWw/BMYkadjcIENVb4cgjQdkNG4x7WRGPN+xdrd6SgyRkXOKU8 /g4UOW+p+UYQVY53XDpTCA/QK3o= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/61773AFBBE4DF929

http://decryptor.cc/61773AFBBE4DF929

Targets

    • Target

      as.exe

    • Size

      192KB

    • MD5

      beed14bc183ad523b94ef6ac2b270b08

    • SHA1

      4ea45e0d8a4d50182063cc97c8a86d579f3adf05

    • SHA256

      b10d9a62edb6081aa9f7fc865554064bb212555392b1181dc40040e12927f988

    • SHA512

      da74c44e21e120af26074fb6493a35067f037cc633e630b415d9b6947c9dc58e354fbb33afc87f733da8cd4d1f8ca66081df0e96d249ffb1c2ba8142c9317196

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks