General

  • Target

    azure-agent.exe

  • Size

    146KB

  • Sample

    201119-xab7bxgfts

  • MD5

    b30ff382e069c56f5e53bb9bb6403965

  • SHA1

    2710508a5a01281e509ed9201bda734d22798509

  • SHA256

    75555df5e8b1644f321ca4fdd0122902aa664257105c5b0e698f402cbc0537d3

  • SHA512

    2b810d64c72fc3485b2ac61451ae4be237ca5079e42f4124d97aa80d07e59ca90cdb0626bedbb7877fd6c877881f72a3384543c0f2ff4f571dd35a31f6bb58d5

Malware Config

Extracted

Path

C:\4nwe6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4nwe6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] ESXI (Virtual machines) [+] Your ESXI servers, are encrypted. Virtual machines and the data that are processed on them were not deleted but encrypted. You can check this by viewing the contents of disk storages in VMWare VCENTER or via ESXI. We recommend that you do not perform any action with VMWare VCENTER and ESXI until you receive the decryptor. Otherwise, we do not guarantee the recovery of your virtual machines. [+] Data Leak [+] More than 500 gigabytes of data were copied. It was not blind copying - most of the data was analyzed. Public disclosure of data will cost the company reputation and financial losses. At our disposal: Projects of your clients, including problems. Your current developments Files related to R&D Source codes of programs Financial documents and reporting And many other The data will be published in the blog if we won't come to an agreement - many media outlets follow the blog and after the data publication, many large media will write about the incident. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7D031C38933EE26 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A7D031C38933EE26 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FGCsUGr2yvLCtHYdU7JtkYj1NlFs3vQ96IUzvqWw50iItIQIuZ3N6DzCbOs55ek8 vtwkrdx0lhuvQDkb/tmUQrBesjZp33gIOLZZXxHGmn2Uk3UHbJdtq+uIyfPI6zcW KqKA9IFKocfT33AGcNU/nhV5xTv9RjR0x56uVziJ43amwiRJez44iNYviSP2rBy3 xp1i0SNh9cX5ckAv+k2iiRTjk+nBoqtgDP2fqwruTJGjcuE5qOB+YxgFPh8Mzrp7 6qGlVq1wSZtB3cbiYjwZHtWGmiAs2QqIDLN2jK6nBgxuj7X47pDbuKsC95J4JFE/ ngIZtIFLv1T21JbzFik5R3XzFbuDEh1Bn/878z3ce7+V5+z2UWLqioZNrk89XwWo xE5EbMplRIeoVasiU32/vzPlg29Xt5V1sTq8sGDsotlaqoIuQ9vs2DLyuHFPN8yg D+SfZNt+wz0V1+73YYYV6MyhDQkc1L7ySNh4Gip0AUFMd/QqzS6GqZRfO4PPxlAb e5voHlxyFvZi9KIwpvavtgpIaQky3HdDqBv7brSldV0tR4l66Gke6G9km4407Huu SlC4MKs0814VIQTjHuar50RT+Gv7q0c/Ew9R2X5QQCjOq6IgvTrpdvJyWpwhyOej 3IhU+F/h3Vi+SBLtx8eG6MFUF9zmqRDPyqgIERX+OiG6O523b4K/JBnLm53HJPIH 8Yr82O8x6YqXA56r9kiR7GK1fX+fKA2UidgTdzSyPppeTCV0xwiNUK8cny+vyG3I Lp0Ke5AgillBRA+E/FwxXZIWBMSVwiWhMkAOI3CtXGXBEJhGTleJj1zZ2ToW+kqN nLeqlC1BrsE5fgHAL925tt2mKHJFsNmdEkmCh5xH0iNkmUC7gggOc9iSOe/p7ZvB 5YnTQZ8TjZSqbSAocbFJyzvlBWprUCqv7wVAk21oT0k9fMvnvzRuWUpJM0XSgFK6 itXsUSWF27lwyXR6Wu3iC6n5uHPnuhXogpwiXpIvBcxWV23MiP9DFTledAfO1cqc JgvlTs5XOIk5aYfe9BctN2lX+yavj4a5x8UEOIxOfvXkBLOUx20D3feSckRbte9u IRbbGgybrzFBzC1NLxR9p9H8+OdBWF6l7GlROJRFNHLnfHlmbIXVKbvC59FedqqP 5qAlHifZT6zM1x1wXLV3OVw2+jpXBmN4Efxfm2ymqXqz2CwRSdyytqbx/x511ZHL 7/Myc4dOvMjZC8eydWAuemVh8TN/m/DKry9I4ubrFa+VomeBc5kUDJ4lf0ng3+Zl aC0VAvGL+9KFoR5Y3QI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! We are ready to provide a discount if your company contacts us as soon as possible and is ready to quickly conduct a transaction. Otherwise, we will not be able to provide you with a discount.
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7D031C38933EE26

http://decryptor.cc/A7D031C38933EE26

Targets

    • Target

      azure-agent.exe

    • Size

      146KB

    • MD5

      b30ff382e069c56f5e53bb9bb6403965

    • SHA1

      2710508a5a01281e509ed9201bda734d22798509

    • SHA256

      75555df5e8b1644f321ca4fdd0122902aa664257105c5b0e698f402cbc0537d3

    • SHA512

      2b810d64c72fc3485b2ac61451ae4be237ca5079e42f4124d97aa80d07e59ca90cdb0626bedbb7877fd6c877881f72a3384543c0f2ff4f571dd35a31f6bb58d5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies service

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks