General

  • Target

    daf87b3826e332cc32fd9a70648f3950f9e99e80ae9e7fe6c2cd109b583a8053

  • Size

    116KB

  • Sample

    210412-q4xtrhafb6

  • MD5

    f210e4eccb14f9508d8b2f3b28b0cf26

  • SHA1

    42f74444094c1f08dd2e34107cb7430567c806fe

  • SHA256

    daf87b3826e332cc32fd9a70648f3950f9e99e80ae9e7fe6c2cd109b583a8053

  • SHA512

    85f9504be1b25311b87f3d7fe0ab83e959988846341a99385d2ef7749618d4ac7461776c6616cb68a55797f3f9bdc0ccc32edd21be21afe49a6ca3bb5e2eeb82

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$9zi/gsGv1Gt.c6P914ti6evj9NZR7Vp4fXE3jqpLwh1tuAX17bLxW

Campaign

6684

C2

solhaug.tk

creative-waves.co.uk

kissit.ca

homng.net

opatrovanie-ako.sk

vdberg-autoimport.nl

run4study.com

calabasasdigest.com

abogadosadomicilio.es

stemplusacademy.com

vihannesporssi.fi

conexa4papers.trade

pferdebiester.de

xlarge.at

remcakram.com

precisionbevel.com

vanswigchemdesign.com

manifestinglab.com

carolinepenn.com

centrospgolega.com

Attributes
  • net

    false

  • pid

    $2a$10$9zi/gsGv1Gt.c6P914ti6evj9NZR7Vp4fXE3jqpLwh1tuAX17bLxW

  • prc

    thebat

    sql

    mspub

    onenote

    steam

    firefox

    outlook

    wordpad

    encsvc

    tbirdconfig

    infopath

    ocautoupds

    isqlplussvc

    powerpnt

    msaccess

    mydesktopservice

    dbeng50

    sqbcoreservice

    ocssd

    mydesktopqos

    winword

    thunderbird

    synctime

    visio

    ocomm

    excel

    oracle

    agntsvc

    xfssvccon

    dbsnmp

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6684

  • svc

    sql

    memtas

    veeam

    sophos

    mepocs

    vss

    backup

    svc$

Extracted

Path

C:\05xbu3em-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 05xbu3em. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/93120EFBC78F9BD9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/93120EFBC78F9BD9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Y5XeIidFl3/WwplKRNn801+455N8xzpvIIRgJJqq/n2sHCDD6iyrxeXapJnlwEnV XXHZtdwm2QKwgpzfOGBh/Pzww4legyogENZiH23eX3b/+su20s2KKyIXNHrz8rgh czTFeBOkumGoJaINAZ5XTuo6m5OrzGz680i2GjT3X1aE1cf0TFXeI5vfKLjtSj+h hSCK65e8jOAqfWYlfxvnhQa5wV6/M/WkvRlDRVdfAyMCe77dUvFtrRNiOFOmiGCw nqGK+rvDdwdRNiQ+GtnpU9jTYgjTrJuTaETgaZJbSZhZZVv6viyH9g2i8tyo+mHH yFlUrjI5C6F40e00xCrvnMKKpLbpOpj5puplCYvdWmn9bXH2R2TTEtVrP4gRhZbj 41AxkuDV/0M2saenDgszGBXEqY2ASvBm3NGu9Zu4UGEnOy1NfvnfBt1mgF+JO7Fy prL5OdvYqe3WIZVs2lX/03ZL7dzbxvmafmM9uXge+DPvC487vqPYpP43NberCuAy j5ZGf30XTBx/kGzkJJ4IuORnMlDKYtAaXZg9g32dbcrWVaVyA1g7NTzUsJ+b5+bw 8NiwNakMkfBDfAZlEnqrKk6PZN/3yKOvlVhQngmI6zAIYCoG96PoqCcOc5s6I5na W9jV5e7Hujl83GeaJ8e2iTbPZ/R134IGG8L9cXRekk+ruuMltzKy9Nj+PPJEk8IK cyRYFLgmzf+bRXil2pbBdSQrF4zkTCcOutfrdDIoKxsgcunLFfNOdjrGiVAYwtXl dsI8Kwto324gzwzkJSWYwjIqbtnIa1KERtTaTyS/Q5TF0E8MWjVsK7Js2ScBgkRE Fe/M5woBeoW1qdvSlUXkd5nk5c12ykreiTf4tHM6TYyBq0xdOvIlMkar4ODfX8S7 sPb4RqtV2W9nkZunetVBU7trd0FItwldTr7eajHn4LKjOOMLGIysCMiK6AZIHMAL NNoQnUNYC7YWVIlw5ZPFxbQ1jzP7N0llQYuUP2xlzCQT5sDFN+J1Fk7bWr8noxoM eTQUcV7bn/lnM+OzCBV7MiqgTMZDijXAQa6qcqtc22f/VFzUiPLnKhy3cY4p7vVd ulD63ecSt22blh3LLhaPkadn3iPf/wRYw85jd8abj8llDh42lQ7tTMPMLjEOLaUd ZKqPbRzdGy1D7mTbV4xVsSa9F93u2UK++aujuSaEsD2/E7uzMPGxDXsLiXySxafQ wEe3/l+qSn6OHydO6d+Gqeghuzc6zUKWRcUfQEH4iJYOyRNsGS0R/KjrFW+2ewsi Sm4muoornzHgsyHrXBe0lZoD3DI= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/93120EFBC78F9BD9

http://decoder.re/93120EFBC78F9BD9

Targets

    • Target

      daf87b3826e332cc32fd9a70648f3950f9e99e80ae9e7fe6c2cd109b583a8053

    • Size

      116KB

    • MD5

      f210e4eccb14f9508d8b2f3b28b0cf26

    • SHA1

      42f74444094c1f08dd2e34107cb7430567c806fe

    • SHA256

      daf87b3826e332cc32fd9a70648f3950f9e99e80ae9e7fe6c2cd109b583a8053

    • SHA512

      85f9504be1b25311b87f3d7fe0ab83e959988846341a99385d2ef7749618d4ac7461776c6616cb68a55797f3f9bdc0ccc32edd21be21afe49a6ca3bb5e2eeb82

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks