General

  • Target

    file

  • Size

    166KB

  • Sample

    201109-9am6g3a9fe

  • MD5

    08782e0adf1d1ddc94e71cead04c0686

  • SHA1

    a2371f36615b6b5a286d75587606acf9826bc33d

  • SHA256

    c2a4efd5f9ba6f03612eb6e8a324a6721ee84166e50a539f789b3fb6ba9e8399

  • SHA512

    122a32536e4fdb5ab639de00a88b5938fedcbc0c0451bb33d03c9780444bbf98ab3de1f5a9d4418a8d4e7f949c932dd7f0cb81ed03646fb6ccee1092e063d427

Malware Config

Extracted

Family

sodinokibi

C2

sobreholanda.com

heliomotion.com

creamery201.com

abl1.net

latestmodsapks.com

notsilentmd.org

danielblum.info

wmiadmin.com

dubnew.com

gasbarre.com

finediningweek.pl

no-plans.com

phantastyk.com

jiloc.com

villa-marrakesch.de

wien-mitte.co.at

maratonaclubedeportugal.com

myhealth.net.au

bimnapratica.com

nosuchthingasgovernment.com

Attributes
  • net

    false

  • pid

    $2a$10$qgbVDj/1NCr2c4z5dQeCKeI77lU6A4ehRqYiRDt5A6p2g/SWqkjmG

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3290

Extracted

Path

C:\95g9x68uh1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 95g9x68uh1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B19F83F5B9490E22 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B19F83F5B9490E22 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WulQC/N1so1FWjEdC4xuMq7jDkuKWDnfjy3QTyNpyDbDwIe52CztanYcRS25cStZ 7yEydiEjG35hMOG6h+2MVGQlo3znETrwfweMxa6uwG24dsLrzD1NLLWtlwxCHsaj P3YkYPKu/ic0myrw3YQqQCButiqA5zd2BC3tIO8hY/uy3oPuF25E/WWnPOtQE6uU NHVKMZHX+xdUFWKzo9+CSF8pwbdQKreuKlL4GZIE05hTFKbAyxTr7f/LVxG+VmtW vAp+brznLZ0PXkYPbaUt+AIQGynLREXRABUiHXxFN/DnvxinGXbpXFJBnDauV0Y8 itA0kh+FM5Dx46CVSHYrm0x2czQbJ7NuwnAbFhAbi7Phupo9Hn0cM+l8yR9DA5x1 TQw71mx0mnBUHFLUs14YucTnlzHSOEu8b4pMwJQwBZKYIXUCKUOD9NZJVTgS0SVI eXlYpAIIfNb684pLkI/nhUAT1yvDgslY5BBsGzLxKhY97CXqU2Cx2dLFCOaVmz3k iSg6S2C/AHp3Q3GmGi7sBGlz2oRl7ZIKSUJOCpNLjpWxRKo3yjNPqdYdFSgNfWwX asxSFlcJs0PaCv+TyGCVVoczHnorZncs/HJLWV2WLuVqjU/XXJnm70TK+rrc5wH6 Zcn4GCHWuou0YLLWTQYieS/Nl/I/9jUS5JVo+6CfLCruMEleb1WUGCqzts8orKYp AKTooyxzYLAgoWy2qHLYLljaSHKeu0oyfh88M0tZtD+RVqb/TsfH7R4Mgk1nZWPc 4SUqWlFbqxEHbwUPLYIQdy3MZhzeX0b6WlkKuOEfkvpX8nviym+0kP4Rppfin7tB gRBQG3HieghCnFIIeQm1yo0Jg8qiHgaxgUW7T1IkoayfMoYjX8HpJpifbd6ycJNg 0+kQvIFYbKBzjidoQ1L+uF7Zddkq7WYaKt/w5dzhNbU8+/TWfJuzYJTfMQQm6veg uDo2Abh+Ct7PNZvvBEvmOdfO+2xHnXlFg4kdgpG0BQexpgY5u7eq8kSWr9Dg9yCX oA9SPcOO4YYMmbsyflfl2jNV1tUnUrSFFkci4iXQx9RzRgXP8x5y7Z1NglIqDxTA mS4syu5/vX/nQmFO9tyMNRtGkpv5c09xsUgJ6ZgIG6/+obxKE3YmIA/6LvafkYMX k+xSUhcMuN75JnIWOG/hiPmntPu20/ZGWZNu0NK2e4LR+R5hJbkRk8ExqKtnBGjr t2Je/tXeYDyVAln0I05Hmk6jEYjNYG6bxU6u5gGFyu5gftsppTmREATveaQ86Dzh 3+aQZxc5xTiE9uO1fup5zf6D+ZXsxmp6 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B19F83F5B9490E22

http://decryptor.cc/B19F83F5B9490E22

Targets

    • Target

      file

    • Size

      166KB

    • MD5

      08782e0adf1d1ddc94e71cead04c0686

    • SHA1

      a2371f36615b6b5a286d75587606acf9826bc33d

    • SHA256

      c2a4efd5f9ba6f03612eb6e8a324a6721ee84166e50a539f789b3fb6ba9e8399

    • SHA512

      122a32536e4fdb5ab639de00a88b5938fedcbc0c0451bb33d03c9780444bbf98ab3de1f5a9d4418a8d4e7f949c932dd7f0cb81ed03646fb6ccee1092e063d427

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks