General

  • Target

    bbdd.dll

  • Size

    599KB

  • Sample

    210212-mmsjrbjsge

  • MD5

    fd6d16ef09a96897604557faf17ac1f9

  • SHA1

    8b702da8f8426af9f501ba546f273c2d5f79f75d

  • SHA256

    3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a

  • SHA512

    d68c63366abcf5b19417d165e4b483cd660235e8ce1b4abaf943e1f2985d8c58f71a03da90c55dc73e4c95945baed3d78d23bda00122ee5bf230e43ef751f34e

Score
10/10

Malware Config

Extracted

Path

C:\p97w46w9t-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension p97w46w9t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/81F9B0D2E6549CCF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/81F9B0D2E6549CCF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: q/avStkvxtCseJr6R4w8H+FP/S30GfpWipcXnqGpGGyuxzapKuE5RH1B3P/N7j/V Oo/WcaVK8FTu8XoSkoXGTaSkzqVdsho/EmW8z/XyeYmihw2dKnZAMSg7NdlWnZFF 7Zg7jzG//HdxDrtLF6LLVAKFjX7nxJzIFeA+dAZdzVoU2QoUuPSPctfiurg9rRo3 s91a2denLf6wYB2+CV708jn9L4RkhgBICFDQwzFu/IxfzqgMgF5F15A3yRXEUdyj ibov1feif+vi3hs7ojVbt2I1MkLvz3KtzEY7fGsjrF+mKh4mtVQJcug1ipXJYBT6 iNoz3umPH+X+/bvLu7NpiT1Bp3OOxRdyjORRwZHHbt8VnMHJcwv+EHc7mk2CMgal HpGc16O1lRiMw0DueHorMYKmmbtwyUawL2z8QOCcnTVJDvumxr9tpttcZJ7yFF8A l26p4ofn2OZxQOc6m19GsxkbfwZawSiP2J0Tt/qVo1o3uVjuSDVdWmSQPc3JFnlj pzd0lF+JH3zYbtw9DdfiGBdMUae+1CG4wAQ81pg3tgLygzF4Az9B4ja/qm3W0LuV BQvQ9ThXGe+r0/9KYuuqb6sL0+cG0yFywna1mekqapb8Gr8QVbY7LrPy0VtfWMMk pv4h2uSYSqwBhTkOCuWe0FO+GD1q1WmRxt6Ux/FbptLeRlsS/mOt3xkUDg5mYkKd EdRqQ1r0blMS1olWc8NkPqAN8LFRxaR8ks1yB1YG6ve4e1biG33SrRQBbgEdBMtZ BEsS63kgzq8Pk+2WEynPxq9h4QNSQ+0vw8OmTA9vnA+EvfZAB3JyYpWh3tWRZ92/ N9KB6Tb+Dx9alOu1tMQ0xzbEQco+TJeMC7aZTvhQpV47ueMUk6JE7e9utJ0v7U0J r/h6RuNh7ztVAK0+nMG8lKzuFXD1g7E/R/cj39wXTh91DBSKSwQRAwOZMZoo3AiG U3kV4iEWzIxZDHn8z1zTP/fTaSiqa9bN/GLmN0L7CRh4mtGoD6g6Bu1ZLvqImZk+ /ddCrULt0UCcPChzCd1eV3rVQhjGA0COzMOE1bIvrPQUH68mll4BRQIcR4PInSQy a/B8vKG+sdXWCbBGfAY+s6oX1quT2tUZoIKIQNsjJ0oOyHUE8HDjFRRRY2AXIJ4n xdnyk9+fsIYj1YWZwGSR5Z7uk3sKVrOI4XHv8mlA+onM5O9i8ILKDN4FaJwFnZlH DcuUe8MS9TQPyZs5XEeXPfmTXdpM2QH94fDcqMPnhkoeuGg8wuHagLp687Dwbv6L sdA7j74JWPu8J09hV3FyAfw/Sn0zRO2ke0cM9Y/pcx5aNPjw8iI= =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/81F9B0D2E6549CCF

http://decoder.re/81F9B0D2E6549CCF

Extracted

Path

C:\4509y7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4509y7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FB713FE8306337B7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/FB713FE8306337B7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JLsA2kYSkqzpGkhJmCILONAOGzRGMXDY1I9w29tQu6viCGkkUoZ4WKDflZ26NmA/ QlOakFfaOBntsHiDJmlCxxf1k+MoRLGhI2dtggLMcCPhFOv+iX1/skut8J0LqYqD AnL/1XHan3KSz2ubMwwHHHMS5CHtqeuYWYMFnwCeYaU1c49mUmbUyfwhF1hxv6X+ KQ+7I+eIRZ20E6gmi17ZBamKPReFFQ2rvi5ksy0qsG8LpVeYl0uk0MuqjUPk9UJI 6OOvktljTsAisHilLgV4inmuC03S6UfipXY0lrWluqbP6N0Dl+0WAgYenk2Zs3Zf PHfgsd/ObE0s1MCzyiMaEcL1Kg7GPBw6n4NL9mJEXSY1XAiyRjcg6qGSKHVHCEUR BCIJls29t1G7jv5sACKh9m7L7054/kC3dpoPnQadoQQ7m3RlokNIoH1lADr1im64 nGxNBuLMRVNqInG9Hecc7LoPmZE3LCp9oyKo0o+tvG53pkBzGqlPgcnz/qFeto/4 3yp+u7lS+4ONkg2FUxfHLFuN8OK3nVuTssHo/cVL9dBfoJiuctCiOvcoTOzYfE8o aATnpYQU0dUerIBBO+FmeNhz1b0+IXprLJ6OKl+KHR1CL84nhMD4bCmhWdb75sHy CNxEFVukQNF1BmJGlcXlNqMnOpRIbGnBFuawf1xDDLWW5eKbS+SuXlof3fYM4G+o rA2FBn1jkRfteqeuxqzGro9aNQX0kg4HEd3fW3rh2zVeBaM7CtQqEB3XcXmqlB56 f38/CUnv3RtmqrI7yUWQu/NkVXKmaEvt4PfxiCufJNWiPuxlEGwG8SwwhKz0NjBk vipMoIkhCJWwwvsryatycHi+tEtEu+neGS8U4SMPFVYtTVuL6v16DOjoF48UVitO d0tHLQI6CBn+4FWywKgHCnn+aHDxV7AIVnmcMLmOvrsY/P2fvMH2yg/+LS4FGJWJ xwhyPkx9hjh8aln/xlLHrSZ8Z9rYONX3chdt5ZZmLZz3WkG9L4TcrA3252/G3adC fL5WV9dzhOBHRxwCkP0L9X9EPQXXb7jQlnIV/7Dk2kIhLZPCnYJdxc/7BxIEuPPd ws8ErWVhpa6i6qGAeMEeVN0+/GOaku7t79u/9QL1vOL9uz3toFWkbD3LSPy7fWzv hOV8GxL6X1DAUyAe4ancbCM1YMOHLERtozYhB5L4ZaO6kiDv7jDh8ix/HGthRgbl oreJtDqnfRRYVyh+56su8LptQXrkZSsD6zjrfUPQTIUgNZtUwjiR5GZwgBSIEBTT riGPHGCeDy+EB0jb/7qf5Q== =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FB713FE8306337B7

http://decoder.re/FB713FE8306337B7

Targets

    • Target

      bbdd.dll

    • Size

      599KB

    • MD5

      fd6d16ef09a96897604557faf17ac1f9

    • SHA1

      8b702da8f8426af9f501ba546f273c2d5f79f75d

    • SHA256

      3f50b89979ffff65668924c1b935cf655b8efc46d4c121ae8627a0474f1d9e0a

    • SHA512

      d68c63366abcf5b19417d165e4b483cd660235e8ce1b4abaf943e1f2985d8c58f71a03da90c55dc73e4c95945baed3d78d23bda00122ee5bf230e43ef751f34e

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks