General

  • Target

    4699000455593984.zip

  • Size

    128KB

  • Sample

    210201-hxe8z4cbk2

  • MD5

    9c552b1a283983efc6f305673b67bc1a

  • SHA1

    640a6991886abb4a86d4d5963e1d3bf33d10af3d

  • SHA256

    143176ce8255860b0e80e5b10380987fe60120c6ebcc8e4a9a5ccd0085bf2dc1

  • SHA512

    9c58df5d690cadd151d3429ff3cc8a3031b7465346fa3bb653baa8a487129d3314afebf1638c87c01f34a47c838fd1ba226bad722de2ffa7fd2f7f40d0bb8594

Score
10/10

Malware Config

Extracted

Family

sodinokibi

C2

entopic.com

i-arslan.de

stingraybeach.com

thefixhut.com

kuntokeskusrok.fi

pubweb.carnet.hr

zimmerei-fl.de

ecpmedia.vn

hotelzentral.at

kosterra.com

nataschawessels.com

brawnmediany.com

whittier5k.com

beaconhealthsystem.org

iwr.nl

berliner-versicherungsvergleich.de

tandartspraktijkheesch.nl

tampaallen.com

phantastyk.com

sauschneider.info

Attributes
  • net

    false

  • pid

    $2a$10$axjojb/dUypiuL2PcXHEtu.cQPssWKGjmzRYHK5wbBps5TYG4EunC

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome iSentia ===--- [+] !!! ATTENTION !!! ATTENTION !!! ATTENTION !!! [+] Dear iSentia, pay close attention to this message because it is very important. When penetrating your network, there was a global data leak from your servers. Except that your network was fully encrypted. We have all the most important data from all your servers. If you do not get in touch within 72 hours, information about this incident will be posted on this blog, which is monitored by leading media in the U.S. and the world: [+] BLOG URL [+] http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/192?s=4ebe6439e68e1c0e8c4f0e75ea532b79 [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5681

Extracted

Path

C:\7dc67t-readme.txt

Ransom Note
---=== Welcome iSentia ===--- [+] !!! ATTENTION !!! ATTENTION !!! ATTENTION !!! [+] Dear iSentia, pay close attention to this message because it is very important. When penetrating your network, there was a global data leak from your servers. Except that your network was fully encrypted. We have all the most important data from all your servers. If you do not get in touch within 72 hours, information about this incident will be posted on this blog, which is monitored by leading media in the U.S. and the world: [+] BLOG URL [+] http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/192?s=4ebe6439e68e1c0e8c4f0e75ea532b79 [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7dc67t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0EF5DF8065515373 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0EF5DF8065515373 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: /oTGi4Ew6n5E7Z/muT4Yzy9u6yFND9W4IXcN2zwheTjJs3eZ/A/8BmM7wwZ9yQjE +1+QYUd/ReNL7BNVCRGnWc4H7Pf99bhzhqoYM9LQFIL4y+xpNO55KiTs5xqv7h0O zyutVotDgE5wu16RA8+mp0ogqmdObzuWxxro2Xj/idPS5mdrTgL+FxwJe8Ec6xK2 DkHWHofyJeiefu5L+A4HxB/MZrn4axxmZf8yaY68WShTyi58l3BChxP/erR75sAe 1ArnBr1/9cTeK9nDMuJVj52dVaZXw9iGo4S/M7jL9FB2fYsviMpIRywSnCBrr3hU j4ScTL3jOb0477QSSGjMCJMqhUeKpMrAdQWJ0Xp9wOKTogVQcsUT0ZYUvgdkfWLf uVfK14OGPU6X3fMmywWDLkQicOaBhr6WIu0wHq7vRTpu+TsJYCCU1Vj2v02XM1IH /BfUuQyOb2OuekrVpnxAi9I5csTpV2ES6IDUI5fU4lQ8xSaaVk/9Mo2PnVaZxG0D 8PUzOBVPlxRCA/78Gj45AAFdxmz676vG9773B0tkEqqrRtqhqyciDnNO9nhPrth9 6uh5ahRYCT1nYS/GH64JhKFP7NYFsFQpSQM42ado0Vh6chXcnK28X6j7L3AKo7tV kgECEVy30B+dHM62Vb8ZOUJq6g4oQ4M46lnwNQoNkT9q5F4epTavtutxsx7fpmrM e84APOXoRMXz+52WUIWR9VQs+lblnAE9+kUWloecHu5ye2zPzVupsW3CsGDCV9wo LkDsev5RvlCxNNUb1q359DGw+nhd2UnmUOYgGavMrkZoFVZjqeLxQEBAfIVT2aXt ojYUiQY/pAIPjRjYc5XL9x5c4+GPmxha5SeHbnuhk12zdwXIdCzeLD/OPCKYZX5H 1hPl/Vri4/UGHa+6V2QHfVtWLgqA1mwhzHEujLeaIzn8U3cZ7lsw2c5cASGUOo8r Zwi1zs2PPI1Uxy9hVbPBqDhcQXLIJJ+qphS7cP8c1G8wHSXJ2Ho1hA3gHmd3QF64 LrbZGERjZoPStOKu6yUMFt13hQ49BnWZwH3EraGmIfT6MriUEzFECE5WD0lD66Nr M5vU7tG6E5C23Wn6EwxoU9eUOPEaCEV7eiQacxC3Fjo2Rexl4q4mdzIUvjUs5BON 39iypx7BDlQYMlPu8spVp92I/EI3FJN08F3r+5jgKkiuuGUHAoy4k8WW4eEfdC7D U2vkcRli37VuDNc9rVgqFik68P8uiGzhpis0bDdEQOnLPRXdDKhz5t83xRf/JgNf XZZItmsPc5JleP88OVefJQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/192?s=4ebe6439e68e1c0e8c4f0e75ea532b79

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0EF5DF8065515373

http://decryptor.cc/0EF5DF8065515373

Targets

    • Target

      d3d192d01fed7a98960c495c35c8af57f393169a48f93879504aff684fb72e59

    • Size

      162KB

    • MD5

      f835c0e60486a050bf39aa5d77e5c425

    • SHA1

      2a75db73888c77e48b77b72d3efb33ab53ccb754

    • SHA256

      d3d192d01fed7a98960c495c35c8af57f393169a48f93879504aff684fb72e59

    • SHA512

      836002c204b6ff2bd2dd28fa36e1fc44fcf812ad249f2cc88c4946eb74f826a4eb73a813772fa6369c4a66cea227c138a5b3aeeb51a27c69ef956503b6f04128

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks