General

  • Target

    bc12fee538246f62c1b34b5e1a48e886bc717b246358f7f14de85eb753fd7012

  • Size

    181KB

  • Sample

    210412-pb74qkhqye

  • MD5

    d357c55d069f009594fd86ac89a33706

  • SHA1

    248f1652515f6845b1304662404a6bc25aaf4a43

  • SHA256

    bc12fee538246f62c1b34b5e1a48e886bc717b246358f7f14de85eb753fd7012

  • SHA512

    478d20804ee97be04756429e9202cb2b35d7c7bc38b9396130cf64319bac75a55620dbf97d0c870cae274976ac399d01b65a64af37efa8b345c6973892e81d78

Malware Config

Extracted

Family

sodinokibi

Botnet

48

Campaign

2036

C2

cascinarosa33.it

welovecustomers.fr

oncarrot.com

ruggestar.ch

johnstonmingmanning.com

suitesartemis.gr

metriplica.academy

alltagsrassismus-entknoten.de

webforsites.com

simpleitsolutions.ch

expohomes.com

apiarista.de

acumenconsultingcompany.com

cxcompany.com

pxsrl.it

manzel.tn

richardiv.com

finnergo.eu

johnsonweekly.com

arazi.eus

Attributes
  • net

    false

  • pid

    48

  • prc

    mspub

    ocssd

    thebat

    visio

    wordpa

    dbeng50

    powerpnt

    sql

    tbirdconfig

    mydesktopservice

    msaccess

    agntsvc

    oracle

    winword

    ocautoupds

    steam

    infopath

    xfssvccon

    mydesktopqos

    isqlplussvc

    onenote

    thunderbird

    firefox

    ocomm

    synctime

    dbsnmp

    excel

    sqbcoreservice

    outlook

    encsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2036

  • svc

    memtas

    mepocs

    vss

    sophos

    backup

    svc$

    veeam

    sql

Extracted

Path

C:\0jx543-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 0jx543. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CC3928DD1B3CFA16 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/CC3928DD1B3CFA16 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7fodmjzH9yDJzT1PFlAj3A3b2hMOLfPDweoPA+Y7K/jT1F3YTtuXh3cVC1mA8x73 /wHaakjRvm38Hr9kjT7xBIed224d3X5gTeK7VjavqCM3nEueX78cpUFndGzsEe2s 7hiN5N4zXDzsWMX2xDeBJfxGhi1C9R3bT8sYNkDUrkMFN2TLWZJBJ1MHINrkoJBe K1WnVMOV2HuAtA3MKaE1rCIMtBBu57ZvJVMJjL7xph0J6K3sACb5fFJHyIVtnsS8 K3nfilMgXoPIhDqF35aCkPuiCo9MvcLbz66T3aIZLFqvFjjaChATznzIWwKRBCDu PfqKXflaEvOqtVqbQ5sjGI14OHyhbN8uvbXF8XXwR5ttamEUBPr7WRDqYawdfMXF Z61uGGvIEsXeS794nT+fqEEeicqvrBxB7t0FYO/iaUUIKlZCyDBIcn4jNUzCas/u xYrYJfC3sO6uazOdD1jcE+AZfVEFtGQG3mt1PXZy4QpNEuDqYDIw8qASZbMGqZH4 iLbqGn+pCv+08AIptAOiFEIwVGnnsbihp2/QKgj7Z87C/TvvLfZoqh3EDu8Yh5XP GIPpdDMxD3hBhXtlndVEvzYOyspuqw6X+fdX0taGUMRy+veJ4X9RwuWvYsfiAwjA joA/LFuVw9UtLzswQyeYm2ntq9eRByQkGrqllgVSRY3yufsO2nvRJNlStglx9Fs0 eRtmdOJSVs7qxVh8FE3PR3HF2/kRc7JoGw+MRnCyfsu5v+cmHO5tb3Islrj3f9zo cIUlEjTiD4ZzdK+bPQrjpswGrrc1O2fkXVs2s1WkgW+Gai8wXKgt2FQm+7gnrzLV TK9SkfjWR6kN1OUsp1W3gCJO+yRseZL7iR4tI1G5w2nSdwLZLALiWB8gUELHXAz/ A1IvU6+xDU9qEb3LW7o6ITFwD/b0W+hH1ickaai1cq9/VrL+5M6XW3FLW12YWdqs om12+AyidX1xY2dKaHesa5FtEiqfWWxm/iPHRuJMPL1uGXcshl1/KhuGYGadAwow zIy1MqGhBj1iqLPl4zo11KlfLHbFi+NZ7XXe5DjrX/U+4hGvqVKbQfRL/qWS721u jMiI/Ta6TeqAg1jOyQ4e3FAM2QYK0SNp6BAYWSg4Z1FBoKY4dnI13z5SZ5g= Extension name: 0jx543 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CC3928DD1B3CFA16

http://decryptor.top/CC3928DD1B3CFA16

Targets

    • Target

      bc12fee538246f62c1b34b5e1a48e886bc717b246358f7f14de85eb753fd7012

    • Size

      181KB

    • MD5

      d357c55d069f009594fd86ac89a33706

    • SHA1

      248f1652515f6845b1304662404a6bc25aaf4a43

    • SHA256

      bc12fee538246f62c1b34b5e1a48e886bc717b246358f7f14de85eb753fd7012

    • SHA512

      478d20804ee97be04756429e9202cb2b35d7c7bc38b9396130cf64319bac75a55620dbf97d0c870cae274976ac399d01b65a64af37efa8b345c6973892e81d78

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks