Resubmissions

12-04-2021 15:31

210412-mjs3k29b1a 10

22-02-2021 08:21

210222-k1twhj5v3a 10

General

  • Target

    test.bin

  • Size

    218KB

  • Sample

    210222-k1twhj5v3a

  • MD5

    12998ead3767b8e2a7d3172432c2347a

  • SHA1

    21c8fb727afbb4d7078a2ce25eaf569c28afb308

  • SHA256

    e275c0b13ef51066e1a5a8d9a3e9f2859d091560dd3c5eac8cd7920bdf3dcbd6

  • SHA512

    252f3159a90dddd528b23d0f6f09ea56eb3470b1c674faa87f20e453f6db2c5939b462dd6a7a77bad2903476aa84efc9ff9c79ef1484e89c2c257820b190c3cb

Score
10/10

Malware Config

Extracted

Path

C:\56gg4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 56gg4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A3937D9EA5842B85 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A3937D9EA5842B85 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WRh6bwWBFrnf5CFSnoc5KoL1XBu3T6cbjgsmqkm+tv4JFWDonSiKJqM7sQjfnpRK 1gUSXf7s3mVvaXYFJU5uDw72A9wGIYuaE61u4AXVkHbNXlg+Y6YJKVXxwjmRNPw9 e6EzczDqVwWmsTrWiaORc4a50q517FDhX4IiQF9oPYNu/8NV1D9f3qB4uTAAzVoF 27KVTnM6LlG4Vv/h1Q8dgyaQDM/Jd4CLsYgCn8C98aK0Qg2lO0p5O6ByML25/nPS Pd8erDOsjZGNmFCWtDwb2xNdbwpVTnBXyllawL+KZapvog8jiCt+b3VZJuAjDPKX eMjIB0ttMyZm5JAOy0sIxWA3QVdFms18QRBjXAv1XZz2Cn2UDP9WHLtEZIHfrIjT Mz8vbuRCrO5PvNhfQDYCfXKkwF0jQhJTrgmjrDSHesQxtKCogrYWCnlrgkEsOo7M zVTv3gMausqBozJe9b54MLBsOSBLhx3MklOkw2sVbuBovlIypUoenK/rYTVGdSw3 Mj4AeluEjXqu+eg3pUApTQLFYFd2XMF9tVR+PfTNJBsumzGSkJ+u1B46VHfbsKHt 4lBpsBXov16YL2Pa1DeRwc67MG3gaPv0DV3ZQRO8okNFqsXw37sfnFsY5ZDZK/Fs Ss6tXENL0lZKrpEkHDudkYSPtzIxI1kG2L3UGuYI4wO9PXhYr8FaJ6llPbBQslYo BOmuIgVeMLkwVNPC7eaGGXGkYXrYX8ZEiI/wZZDV3Rt0G02XcJIudTev754GL4yD uTs6Fx27NsKlGFm+Tariuh8mpzW1nxYPXG/GUoqlXqrGTesoF/Ha1EkOrvtMD5Af NTD4dJqay9uW2pzVxQrhQoe4ZfT8KQBJR+85/5Uut5NQpb3Tv/MK+KwsbAK7WBh/ OUve5IRAOqbrWrSIZAojtl5CxmKX3IgeIYwRxxZju6QLVoVVlvSeQmVQDGYYiWv6 Upwu+SNGJ877/hGoWjQ7Qm35EjycWOkA63UKRZwGH3ApTmwffAdTYAn6UcKxzdRD pp1v54W6cMEifK8kKT234R0ESUJzazBTzPIV9vycWx8YAM9O9lmDELU1N3K+/4Ml djDDD4vJwyv1xXMgOFJs2qzVpePE5Z43lBbT+Se1edM0SbDbbaPvXGJBD53svbDd Dhh9m2qPDs/S95kWFrteV7079kdacWovMyQuVN6J6ACcpaQay/EV6P0RmlpHZ432 TF9X3/dkQbBEqwaihWokbFlw0U6Kada0W2Wa8OZbUhoYzSw3YAnvITViZFcX3RJp fTy49ujNbw6TtYy4rBo= =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A3937D9EA5842B85

http://decoder.re/A3937D9EA5842B85

Targets

    • Target

      test.bin

    • Size

      218KB

    • MD5

      12998ead3767b8e2a7d3172432c2347a

    • SHA1

      21c8fb727afbb4d7078a2ce25eaf569c28afb308

    • SHA256

      e275c0b13ef51066e1a5a8d9a3e9f2859d091560dd3c5eac8cd7920bdf3dcbd6

    • SHA512

      252f3159a90dddd528b23d0f6f09ea56eb3470b1c674faa87f20e453f6db2c5939b462dd6a7a77bad2903476aa84efc9ff9c79ef1484e89c2c257820b190c3cb

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks