General

  • Target

    d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682

  • Size

    116KB

  • Sample

    210414-a6khdgkwg6

  • MD5

    c75f4c8e053f5aeafdf0169698b7823e

  • SHA1

    be6cc1941aeae4ba84715d5f197089fbacecb788

  • SHA256

    d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682

  • SHA512

    83787bd850c6ce35fd1fbb511204b60a6cf9e8ba1b9b08af812608e45f6b1e8aef371e2c7e5eaca662ee8f86bcf41f01bbce47cb685b32c138de12e8998a427e

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$4Bl3byF/SZs0XtK54f6dl.EeEVpkFM.N1Ld5pjXy9FkLLOJzyPkyW

Campaign

5743

C2

ussmontanacommittee.us

dirittosanitario.biz

celeclub.org

csgospeltips.se

urist-bogatyr.ru

joseconstela.com

lapinvihreat.fi

alsace-first.com

johnsonfamilyfarmblog.wordpress.com

dr-pipi.de

lubetkinmediacompanies.com

twohourswithlena.wordpress.com

edelman.jp

zimmerei-deboer.de

exenberger.at

adultgamezone.com

wsoil.com.sg

allure-cosmetics.at

rieed.de

sojamindbody.com

Attributes
  • net

    true

  • pid

    $2a$10$4Bl3byF/SZs0XtK54f6dl.EeEVpkFM.N1Ld5pjXy9FkLLOJzyPkyW

  • prc

    thebat

    sqbcoreservice

    ocomm

    mydesktopservice

    steam

    encsvc

    thunderbird

    wordpad

    onenote

    ocssd

    winword

    mspub

    excel

    dbeng50

    tbirdconfig

    ocautoupds

    outlook

    sql

    firefox

    dbsnmp

    infopath

    powerpnt

    isqlplussvc

    visio

    agntsvc

    synctime

    xfssvccon

    msaccess

    mydesktopqos

    oracle

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5743

  • svc

    backup

    veeam

    memtas

    vss

    mepocs

    sql

    svc$

    sophos

Extracted

Path

C:\w5813-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension w5813. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A50E2C07329F83E2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A50E2C07329F83E2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: BVY4hYr9DPMofLQLlHpS47l0TvcLDEqilraucg+bTDKkseS5drWxsV2GEY6GLIhm nkyn5sC1ekAwlrJE6PwCHS4JRS+2awh1jnKqbSV9EBY81QvkW+oT8wFUwFo3PahY YdwzpBVr/lv067wDjIEpGb0QB38kXnLzLd4RlKdSWICM0ZblBr9xcESTRoprZ4G+ nDQLKgO//LrNjimc0CKipKhV01oLK4kwFBO/UKO3sXEqSS/X8DtfYqMd1n+7ju05 LkwxeAY2iaM7J4ciplHSljspsAaM6ihjv4H060vlEIS4VEpqW372Nxnfgye+xqRN wawXkv0tEyWKkGNNN1unbXOpQE50b39VqQnxOk4BhSYX60Xhv6wLoetHpwvsUzSB IXuG2qc2GndfD20znhR8K9SCe/nozAzFCVRcNTVrsWgwN3jtXCgwOdyN8H+N8qP2 PS7TYXOywKSmxfYexiFQer4RwbJQKL6zEHoPcCRQWwjsP4O2ndKtyC+Bi2rZ4ee3 0wSXeWpu1LoFsAAWCR1NdqlZ6tssYxlB3e/EQA+uLSe9YWM1nR0xCsA3O9lfyog2 TefrcN5MfIxBGesDfe/twICjCgf8WXUNtQq7YwWzLpxPWPi3xtrVGhoXUOx/LnJR z8X46fL9B4Y5HTGRPIkUaQlz22ICKBVzjPIlcQ+wsTAbAOB7LgKns54NfXx5wu4w +tr2fiLWVYecJzlKjfvp6vRCVxyrP5rIOpO9CkdtpcSpVWikdht6QzxWZR6cSUmn 4DvlW3wYjZpDJeJR79SOdqDO7SRYp5wiOZ0zQrHukmg/+bcHNH/cAGzV+eNp/J8O FTtSzw+hlFsT+MnosdqlAbQoL1EQnpgAOlP1kFl8L4jh+ZF/s48mzFpIklQgXXEJ qofoLKL7qnZtQ05iZUmyb7SJk4jDFgIvT2fjCcEg2TpS1+ZJUzSiFzA3ESpFKgrw dwA4qdJlqbUr+klAPrR5SgAyDRGhKw0Ko11DSpuCLT00N2ZZl0XpFVZUsxiDKFdN 7G6ce9v65CXwDxfH9T8iPDMKCDkmcKRssV7TYm3gTn+ZyIox3TSCaduU2W3mkmUJ j/v00MEXG/Ne23HUEf20ALxkyv6ld482Xt0QFUnG9FHZpF1QN1Nz9Ka5qg8FKXb9 Uk8aJQRBiPWutV218f+nzkkc3cTarFs8AoEctAje44pHsDjgHF3HUatGiPEO9uts 6WzzClKYuqR7YMNuuzpkj+m0a9TH0pyZPgkG2iKJ6arWXANp6nNU1sEdj64aKSP0 scIcQNs0G2GY5Q7kPQ4= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A50E2C07329F83E2

http://decryptor.cc/A50E2C07329F83E2

Targets

    • Target

      d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682

    • Size

      116KB

    • MD5

      c75f4c8e053f5aeafdf0169698b7823e

    • SHA1

      be6cc1941aeae4ba84715d5f197089fbacecb788

    • SHA256

      d2fcfddfcfffdc2236e7cf7ece8579c7c104a333ad0697304392ad0629541682

    • SHA512

      83787bd850c6ce35fd1fbb511204b60a6cf9e8ba1b9b08af812608e45f6b1e8aef371e2c7e5eaca662ee8f86bcf41f01bbce47cb685b32c138de12e8998a427e

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks