General

  • Target

    5612552582365184.zip

  • Size

    84KB

  • Sample

    210201-r1wnwlaqha

  • MD5

    4ca84f257c59691bcf82664fae40f0f2

  • SHA1

    3b3718ce201fd1352f95785ad6789fc9a179e491

  • SHA256

    2c6e14e4675b318933d73e3377831f25056e3222f0abd13b6b9ba23a0b669868

  • SHA512

    a5e7ff43dca7231b1b23798559db30ee601bac20cfa700f671d0616d14cd1c78b3587786ce361b1b993b12e1ba568e911e7429e0d711455cd29bccbbc95a044b

Score
10/10

Malware Config

Extracted

Path

C:\2lsx5g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2lsx5g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7BF64018E3D814A4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7BF64018E3D814A4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mLYy4GCT/6nywzB9h1vhqjj6gfVqQXeESMS9/iZOCrfZ1+RGxoLLWw2L8j0zAOKe ysbxKePbORzmQLVyeq/ODOoNtLNnDFLM7035UEiQoyll+y44lAnIlgcxA/iC9XdY 7IBIajXdaMWIGnnNShr0RjeIIt2OILvIIiUdBFaUboFQyBvcxWug9VegijA7McTP cxiNzF6mRjHcSWCM2wGBCI/cGSxSdzn7d5I6BbmLtTtnfyB+zn8+6sCsg4qRDo0L nevFnTCccO6HgEw7ZHYaBs2Kg33UJXxZmi8l2ioKrPRovb5YjKtgiv7xlZC9U1e2 o9IJo6Ml1vZNYMakqSvnJfGOFwj+kI9H1bp2OuBOa+6eIIDfZV4L90toOEeV6LEz Gean+e7m0UMCNDrIkOJ0O1AU1uJ0t9SE5re/ZPakkKL6DG0Q139kppN3izxmzrnK yjIeHSsfpMjCsw16tg7/+LFXRWkUPY9A9h9NxwqSMNKUaaeCxiTWco0/e4EoeQOm Bn+Qe0SlLBkgl/a7N6tLClb3zVtGoaTKktuvV6+pGtaoxQ4KHkW4Dh285xy3k4cW bsablkbr3xzuwwjcS77wbUdR4lJAw9/TEizp9wvHDxRmV+F1jmzvvUvMmKokPnIR DY26J4no0CR90LCCOpzE+bYQ1ailHjf0DiQaYdhxO/E80wlpQk/HdX0kK+ycEXdp PKV9/umb49x30RR1xNAMKckamWMtOyxyH4Os6KyAXFN0afT+x1uGnr541IBKORMI 5h1iL5FRdDdhy7d/1ZLFHRL6AM2D6uFtrmEoFLlkdrY6lvKaqedDSCWr18F8Gf6b ApOOPl+H3zr4UhWutkC2q48W5MrqhPoHcjxd9rIvhl5y+i8SfyBtXuhY/HJ+l3ug htTPdWLXsIluTnubfStnvcZfKv7tv0NqBk0+o3KXI1A2/aMcWY/NXuwyGIp19bDf rbDHye1HBVm7S9GKoRPzXMYSLD645DazUDybe45wH+2+QLQFnMX+JT7GxRRUXMN7 sdxPma9vH5v7gQVx0zBkmqlsFCCucwvy208bGBpMort0oHkg+3xIPjPnbVPzG42G VFXxx9f6S5tIXhStzfckPZseSwjKLifNMWgbv3H4veskomcBIauyZ7xHMiHsHVwn RjOKINeo5Ya7/h3OhXZ2zYLEl5BaFgWFlBG5ogjzE4kPJpZ10St0grebUi0lSPUU eIg6BLZk5SVIPksaMpTnp0Pg0yjIxjL9PezTw4J194qIqDllkUMYcW6LCjLIFGjq UWbx8brCYLmNMwC74G2PDA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7BF64018E3D814A4

http://decryptor.cc/7BF64018E3D814A4

Targets

    • Target

      801e1f5f623edd2771367a79c94c8d9414f2d8f6af5cec707baa410a1ebf4b75

    • Size

      136KB

    • MD5

      c2ae29ea86b611d8697ca715e61045a8

    • SHA1

      58d835c3d204d012ee5a4e3c05a06e60b4316d0e

    • SHA256

      801e1f5f623edd2771367a79c94c8d9414f2d8f6af5cec707baa410a1ebf4b75

    • SHA512

      571dde42ebaa5c373bcd1cd8c08e3d4d16945df54659f64ccb0e8e1bf721c11d20ac35539e071dfede3a765d2abfd6546225fb72822fa1e3e4095459b539822a

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks