General

  • Target

    dca67beec84cd005d40d0331d245768192156725ac4d4749487f45ec654865fb.bin.sample

  • Size

    285KB

  • Sample

    210401-zprbqfd3qe

  • MD5

    380d06b2381f663833251ed48aa677d9

  • SHA1

    403be9463d5ece4518f569eef309ec8ff3fc3d63

  • SHA256

    dca67beec84cd005d40d0331d245768192156725ac4d4749487f45ec654865fb

  • SHA512

    432250b4d8ae03123098ad15643e5ef2b23689287fb4f77a97e0e5f58f64f85343120f176b57a7612044d4fa58f31c78695f1a452e7b6cb3301aaa75bdcd9d85

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$feGxyJfzJiHLU1LiEiDai.srwRlUdp4uT/rdcfHlLaso05G0zM4AG

Campaign

7195

C2

logopaedie-blomberg.de

bigbaguettes.eu

alysonhoward.com

365questions.org

associationanalytics.com

latestmodsapks.com

romeguidedvisit.com

jobcenterkenya.com

mmgdouai.fr

advizewealth.com

sterlingessay.com

simpkinsedwards.co.uk

siliconbeach-realestate.com

htchorst.nl

rota-installations.co.uk

cuspdental.com

noskierrenteria.com

knowledgemuseumbd.com

bee4win.com

people-biz.com

Attributes
  • net

    false

  • pid

    $2a$10$feGxyJfzJiHLU1LiEiDai.srwRlUdp4uT/rdcfHlLaso05G0zM4AG

  • prc

    powerpnt

    mydesktopqos

    isqlplussvc

    ocssd

    sqbcoreservice

    agntsvc

    sql

    msaccess

    mydesktopservice

    thunderbird

    firefox

    visio

    infopath

    wordpad

    steam

    dbeng50

    thebat

    outlook

    xfssvccon

    onenote

    encsvc

    winword

    ocomm

    oracle

    ocautoupds

    excel

    synctime

    dbsnmp

    tbirdconfig

    mspub

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7195

  • svc

    vss

    backup

    svc$

    sql

    veeam

    sophos

    mepocs

    memtas

Extracted

Path

C:\7snou-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7snou. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/014FE5B8EA86E898 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/014FE5B8EA86E898 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FDYbr0TIWETDMKkpr82LrPAeXFaqr7extV4wqjRAX3HIAhaqy+Yn5rqy3SgYUtPe eu2xkppdGwr95U3D2CJ8ppSxohGUPaTeaIzZ4ke4XzlP8Y94gLVFP8rh7YILl3am 6mHxbE5fsxPDo9qi/7tcWXo2e560jHb+O/lwR7wMp2ELB0x/IiyZG2hBceBUSdNq /EIAKThNTjEr/RSHKtBStSFK2E6F0by8Af3Ue2gbHMVV2JlWm2RIvENVko+PaD6N dWn81hbR741pcsgQyJ69savAUOHglqM55/rorvZqcZ0w3kdYJLQzRreVyn24QPUc x4fgVG2g5IMXj6XxOiqd0aaj+DPLLXKR8I7s9hN8/X/tqQ3aDtv4clHWK87lyHQ2 Ij4vZahHv3deIyarVL8JIoWyRQJcVc4cF1x1FjqPSz2lCrKxvSFkCGnaRNep9KB3 LmqomKx4KRaJtHKXN0+Wnmi1DRlNkjP503r8ASlvfAXcMJKHRy5HKgwfVqeo+5I0 A9vsTH3xuISmlfcTswmUlb7ezk1RDgGF5anmFHo8KGq6oGcCGviwT8WRiSa4668Q GkfudyCCq4dlINoPMN6NXN2Q32PbrF5og0igwqi+3SbT/h7gzVRL2MFOttZrxk1X Yr6MgLqVOcy9ypapS1sPH4Cxv7zCnhHQK79NayrpRG/NEcNyVWmk9ZsPxNFtkNZz IAk72zoMS5OzjYyFWwNFRgaKVAaHfug0OWH5Tcuq4UEsU6cRD5AJKOObZcv2SJwK s4i4TVRwlJ1kPMD2u13FPIdRj1MVZAWgxeplHl36UHcDQK071fu9ZMd5T0K/LAWG 67Nj2ZTZJcMTkKTrRueUNhndr4RITSigifbMOAjRq0Faz2sfVhiGoCnGc80aR/oh snGdWYpkH/8BM0RpCbPEzedpwzHrNGv4qtLF87emEL1lTcRC338+GzO74VBFzXsi PNbZ3E81UuR+h0wNt8cQtEFkmQNJzr5HR1/QlwxfKViUQ7LbyTp4v9MPWa3xhsbE q8pod4plscV49DHaKHl11huH3qbW5SVGJLiJTfjyCiw3v7i8aUQ7mgKorDNDCMgU mir1js2ZQMqUyMe2zs2sj0gIu+BeNIQjQuXkATnvBO82HTmWrXdAF05sZ4iG1ICR 6+S+xzPjZlauOTshYklvOSU2g1qgL8nr4iGU4rSOTdcI9o9HNL+jjruDyfhrEozw 7tbI1aQF2ZlI7NijIPb1wDtgWr5whblYEy71ihqPBwk6wZB13HZ3YqPL4z1U7l3K 3pVugA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/014FE5B8EA86E898

http://decoder.re/014FE5B8EA86E898

Targets

    • Target

      dca67beec84cd005d40d0331d245768192156725ac4d4749487f45ec654865fb.bin.sample

    • Size

      285KB

    • MD5

      380d06b2381f663833251ed48aa677d9

    • SHA1

      403be9463d5ece4518f569eef309ec8ff3fc3d63

    • SHA256

      dca67beec84cd005d40d0331d245768192156725ac4d4749487f45ec654865fb

    • SHA512

      432250b4d8ae03123098ad15643e5ef2b23689287fb4f77a97e0e5f58f64f85343120f176b57a7612044d4fa58f31c78695f1a452e7b6cb3301aaa75bdcd9d85

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks