General

  • Target

    510c4c7283b3637947781b8a568c23de1896601813aad52062e319dbd9877329

  • Size

    120KB

  • Sample

    210319-j3hxrta6aa

  • MD5

    657c649437f3a74dfb90b5fe767d326f

  • SHA1

    341ad6a639fb7ea6d3fcfaf976cd78619bf0c35d

  • SHA256

    510c4c7283b3637947781b8a568c23de1896601813aad52062e319dbd9877329

  • SHA512

    2a096d7dcd3f212d32d6122952d56691c0a4be6f02a5a2818218b7e0da4abefebffa2c7f93a56c7e74463f5b743d0e6eaebfb93a8238770f37f2ce43826e9d74

Malware Config

Extracted

Path

C:\1z2t5cq47x-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1z2t5cq47x. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AD20B48AAA252385 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/AD20B48AAA252385 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: oA1aqpQF2wQ5yv8ZgJlAuPGATpA+9SpiC5E5nURjDsPwnr/yiKrxjCVcvMx2OPNC npppSbHDZYkCS41r7aeQ1yDWdhgvodBU3TBNYOCUhH0bO8xCB2AHteQIIHaconES 4JXmL7ggNdBr+/gwfW1AlYXsDkePXKlfgpdktgHQ5Lf6bgwsgnSFj0RiQHfGsW0/ NrN2x+7Mbu8f3qcdFrMcZ58EmhLyMj/Lcv6viOV2LTHEJ7z+fs3vU/ZM13skHEAj nNfTjJyxJHzbzW7OTOBnH7jdubzzbgd3AtCg1UdF5YWMqfcMffFJc7DoKU4ZD9Oq 4zIn2QW4Rkq/id0GNQUiWZIndbSd5U6Y1d5gkkfbLpRwzxwHYXIfM7S9LMaIw2VE bG2dpI1g/ZBd8FEXE3r7OEmsZMCSC8ysiE8o7DawpuzlxOGK55OQ6USDy2j8EMce X4WB6DOiGwTBnTN76qHnRvvN510lIoBctYKDkhyLaK2yz+g33HeMk2JmwBkFs2La 3j6Iyi7HEZ/wL81GL/iIUEPrqBr9ArGYQgC5L7TRZ4t3jm410uaJW9oMIbRLRgWV t8bfih57rEtt0oKR5Tjt/CDJlcWtJA9n6NQ7fRkq2WtoCQMZCJGYPaPca5G6qCSY bdZ2dfGu14FftAJQc50Slg4fmS3wY3MXKmzVz4XpIUJxddZkoR2BoX5xhFv5N9Ss D2ikJvjCzLMAKYEY1nmio0rJeUWIG7Y7q+dbn+NfxCImL65zfTyBIlxM9GseYmw0 FnTwxf6xhRibcDscD2RcZZFegdxgTBjpkEe3M6aCiEENXMc845iXgA2a0p6Crqc9 FBpjwTdvQf0/EyNttpbId/udAH6/oExgdxYf9cO5gK5E44a8cw4gKhwrh32cJNHT oWhsmrBa3oAUngKMtBQ5pTzcLXP0mibFqRAKZHUx2lBN9boVzeatltR7zlAbNRd5 ClqLYm+Xz0gX6igsMDoT6hJKhrQYVquKSFGzE4GduVk1EVbcr3TdVApIeLHExPrm mp7AQ+Nd9Msb9bmHs4Iv+GHAez/VgMAFdXhVnXhbAf1KyOrvf6cCxg5fLXB2SumZ rR7Wj3l8k9GwX5ZpVCP4dY93dFOXN/ZcDMP4zQgFm4l3X8VlHx7A53hSte0dYJZa TJ3IiWdcV0xwhG4okZAaXTMUvFB4qqvCAuzxuvax6vww8+wMjgrAnL67VZKGI2/s CrkJR+ejeQSn0DeMGqyy9UOat6aZepO0q54+2iiq53qubo4eefCNFJxbyKf4EtA3 n6ubg32oqxb3aTqEie8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AD20B48AAA252385

http://decoder.re/AD20B48AAA252385

Targets

    • Target

      510c4c7283b3637947781b8a568c23de1896601813aad52062e319dbd9877329

    • Size

      120KB

    • MD5

      657c649437f3a74dfb90b5fe767d326f

    • SHA1

      341ad6a639fb7ea6d3fcfaf976cd78619bf0c35d

    • SHA256

      510c4c7283b3637947781b8a568c23de1896601813aad52062e319dbd9877329

    • SHA512

      2a096d7dcd3f212d32d6122952d56691c0a4be6f02a5a2818218b7e0da4abefebffa2c7f93a56c7e74463f5b743d0e6eaebfb93a8238770f37f2ce43826e9d74

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks