General

  • Target

    file

  • Size

    164KB

  • Sample

    201109-xvte7jlbcn

  • MD5

    0192dd37e2473913dddf82b3912f928e

  • SHA1

    d4ca6df549db7bb747ba63df70720cea68679b07

  • SHA256

    b7ae1fa5ac7ee65dffd93e9defd51b2e39a1030620560fe9eff51315e75c8885

  • SHA512

    939e359de10339bdf5a23990bc76e41a82d199a425931ceb0c2870babdb2204dd3dad567801e8be45d1df9500d438fe30b8b1274c7c785b64846e919b2f2c88c

Malware Config

Extracted

Family

sodinokibi

C2

mondolandscapes.com

frankgoll.com

peninggibadan.co.id

invela.dk

g2mediainc.com

yourcosmicbeing.com

phukienbepthanhdat.com

dinedrinkdetroit.com

sarahspics.co.uk

parentsandkids.com

makingmillionaires.net

nexstagefinancial.com

so-sage.fr

advance-refle.com

ziliak.com

metroton.ru

aceroprime.com

designimage.ae

jonnyhooley.com

plbinsurance.com

Attributes
  • net

    false

  • pid

    28

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1819

Extracted

Path

C:\yg2vdd-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension yg2vdd. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FDC946F48489C9D9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/FDC946F48489C9D9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yFJ27M1ZFtq09beXraSeJnlcx3j0fTcbGvV/Cgx2RkOtZjsApVBFUywqEjVY4UEd 2UHwDL18xIyTSkzOuHGqr3+BFAcX4szMz1eMFMkPLMknIdKqggBXSJCcQZZFCs6O ZZogN2DebV6VdPjeJAJcL0s9yR6YniK3KsW+ttMJnrh5MselqwxdCJPhOwhsheMu hAJ9YE/NKrmXAeZAnXt0DxYNPX0eJDoHwKOSFWyZ0CVhpIZYvs4lIWXpaSitbhM1 726GNWEH3GWCMiz8WqS7FOdxqSppl4ylfNI/3ctkaYLMheWiNMBwYj5e5PdUJCHY m9Rryi3nAMKU4Pq3KYWJ6x8nBP5cml7sbq5AWFr3Jm4PIC24JXTIEmiATbZsEJwJ 3u/y4YRPPYERQteB8AU61kB1NASkJ5mgHI4oZ/W+c5X9y3i886KgXnRkb3CKbiK8 6V7aqcyzGupmjcP4Qx3l0o+bGRtr1zmiQa2ZaDnIVTCby9TqiEzLFE5Xsf1ECO24 KVIFvL/+pK6mzN9gD5wFMZa3Q4vkn7uQIstjXRShyx4POEuOtQCGbOrxncRLXnJH gNhMnwUZ7Dtv3QYNuuDZBQ5AC5N1Okw0I9gMp0SpQNyklOjik/BHH0gQDvMb4KXd S9EcznsmXu1MxP31auho3+RiclCrPFqFm+VPirNxxpViCIFy3RTJ0I8rPKPLH7wL k3WPsUdp1C4DIsn3Sub//YKO7XM5K8wdtUzACvCwM0TQwharyPcORULIi0zT4gcm 8BBbnpUx9kmDlgqNfpkPRKlmrijC1yKkxTD5OnAHHfLrDT/k8fPGrDB7sN2hhkC7 Gc83ZA90ANPrANST31R72DboZUFOCgoyFAUSmwg9ib85lvvtI64d5ji2/OW2ZJkC KpJExA/B6EPe5KrnSdv/uKuU2VA05J4tUCyubugWs/PfjQ3D7xV6bkasT1n4BWjj Za+qxo6j91q9WbvZA8UuyM0zW2tCUe90Rg76Oymf0It3B5wx55F7emGE2ZVUWlyV fWb9+FHURh5AivCoTil9xMsWdJdIoD8iyTTW2gLp6/Yaa51EmA5sqA8BGPVOn3e4 Bu0QPvFpH5eb77I0S2SXNuF9BOTW89th7SLefuHMa2S0fKcSn7UGpHcxIIk= Extension name: yg2vdd ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FDC946F48489C9D9

http://decryptor.cc/FDC946F48489C9D9

Targets

    • Target

      file

    • Size

      164KB

    • MD5

      0192dd37e2473913dddf82b3912f928e

    • SHA1

      d4ca6df549db7bb747ba63df70720cea68679b07

    • SHA256

      b7ae1fa5ac7ee65dffd93e9defd51b2e39a1030620560fe9eff51315e75c8885

    • SHA512

      939e359de10339bdf5a23990bc76e41a82d199a425931ceb0c2870babdb2204dd3dad567801e8be45d1df9500d438fe30b8b1274c7c785b64846e919b2f2c88c

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blacklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks