General

  • Target

    090a89db00baf8c2c4ade759a9f3c5b39d2e9dc2d14bae53e13ff6b20dc54547

  • Size

    181KB

  • Sample

    210412-syey32pjbn

  • MD5

    b8d67b5170de20b924d030512db03832

  • SHA1

    e638d27310faea2f8df631b03d4cf9c8755f9df1

  • SHA256

    090a89db00baf8c2c4ade759a9f3c5b39d2e9dc2d14bae53e13ff6b20dc54547

  • SHA512

    f033300d1ad0ded564fe6f79f16656600ade463ab93b52548f2c5bda0444cefa3a5a8ebf4801e9dee754d873cce07d5ff2a89c53a4e0312d921b94c1e68395b4

Malware Config

Extracted

Family

sodinokibi

Botnet

48

Campaign

2036

C2

cascinarosa33.it

welovecustomers.fr

oncarrot.com

ruggestar.ch

johnstonmingmanning.com

suitesartemis.gr

metriplica.academy

alltagsrassismus-entknoten.de

webforsites.com

simpleitsolutions.ch

expohomes.com

apiarista.de

acumenconsultingcompany.com

cxcompany.com

pxsrl.it

manzel.tn

richardiv.com

finnergo.eu

johnsonweekly.com

arazi.eus

Attributes
  • net

    false

  • pid

    48

  • prc

    mspub

    ocssd

    thebat

    visio

    wordpa

    dbeng50

    powerpnt

    sql

    tbirdconfig

    mydesktopservice

    msaccess

    agntsvc

    oracle

    winword

    ocautoupds

    steam

    infopath

    xfssvccon

    mydesktopqos

    isqlplussvc

    onenote

    thunderbird

    firefox

    ocomm

    synctime

    dbsnmp

    excel

    sqbcoreservice

    outlook

    encsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2036

  • svc

    memtas

    mepocs

    vss

    sophos

    backup

    svc$

    veeam

    sql

Extracted

Path

C:\2z1j182-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 2z1j182. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/10E425D59A3EFCC4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/10E425D59A3EFCC4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8U/6GQmSrUSw8GrHxpuHbGmoCwJlntSmodqn/ccPBzu4lBbXzFo1xOX8FnCcCL5y cB2K8QOnDZ0l2ahKbIp9957dqgFkvQNuZvjL1f/VHReynTnLeTzbOlXU/XBThp8j o/vTVD91XFMsqorAPx/U0RCIQr+oSaZ2MxVlaAepm9A6h3nI6Fnjyset70QnKqaw xudMn87m3OT7FmaiELFFYasCyl58aBj0XVmnQzbrQOCjyt59cBHeQiRnAt2HQzpE /r5DlQf+ZkGkgKhYXCD/j3stKend9EqcbiRSpAi204udzEKeqs4BW5or3mWmovK7 +/7p1oPdaNluVTvF6goY2eqzkIIy9+t3LXc1kcpXk0RNx5ly4Kx20bQz0cEYfyUQ v9gBN+UXlLfc3LklTVr/+UeP9pAS7+bmawRMolU2lBQu6wvYTVidvb3GDQ5L2lW8 nncg6IVRc7OUGJD7KGjE4HroE6e31oP6CtzAmLNy6A5vaZhsgB/Ia2OIE8Bnq9Su yktNBtdbtyUzaJD9B07lUeKFaIgeNSKaVpxcvFZNRGZDg4oWPkA4HPWlffpu2BgV Z5NZjbxpecQaQQMGfeq0pW/M4EvC4nhcNAWbOXMvRYnQq8JSTJAhdXICImWXID7m nWyf06/wDXIrDWfUnM+zTTB51m6UBOL4c3UyJTMxg/zpiE1h6X54SZccdfGIIZIL GNrVhL6W21QpKNXiz/qZWcTDP2AJf8tRrXNhCprojv1ty8Y85xUd1VspooiunhwZ +VJdQISDbKsE6mtsck53Db403rMzPBJzmwEgdLgOAtGbeN0M/lSyCdxGAg2lK59o zG43YkjYKlqDQ01XSPGlJidJkQIXVfrZxTE75KS1e04OPx4Ew05AB+vt6/gYiF+E IiO+XOu9gNn9hBm1ijHgspfC5bLNDfSoupuWYAo1WHAexSNGd+v3S2axEG1IGBh3 7etRHkv7c3XtOG8zWMSdEpKxICwVvRHVfart9KOuIMim+UukgCdkGqJ3pYc6BARV qotArKCsZSXIEdfmhk7ZcFJE/5sJ+jVeXal8OWVhpsRYgAmT/R6PRhouaNdK8JBW vG6MUWKapQ1m8qaLksTcSVMuTAP79VyAXRw2mgcBWhuZu/K1Z0Bn0wGz0o7BFA== Extension name: 2z1j182 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/10E425D59A3EFCC4

http://decryptor.top/10E425D59A3EFCC4

Targets

    • Target

      090a89db00baf8c2c4ade759a9f3c5b39d2e9dc2d14bae53e13ff6b20dc54547

    • Size

      181KB

    • MD5

      b8d67b5170de20b924d030512db03832

    • SHA1

      e638d27310faea2f8df631b03d4cf9c8755f9df1

    • SHA256

      090a89db00baf8c2c4ade759a9f3c5b39d2e9dc2d14bae53e13ff6b20dc54547

    • SHA512

      f033300d1ad0ded564fe6f79f16656600ade463ab93b52548f2c5bda0444cefa3a5a8ebf4801e9dee754d873cce07d5ff2a89c53a4e0312d921b94c1e68395b4

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks