General

  • Target

    2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample

  • Size

    161KB

  • Sample

    210503-4ffst7e1tx

  • MD5

    d599cfe7691e8499941d7e4f0d51616c

  • SHA1

    843070b5c802a5dbc9afbbdf03ee1153f3249165

  • SHA256

    2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507

  • SHA512

    f04a3e88dc69641e0682d6e74a7ac75f80e06924f3d25987e74674d9dabac040a70164cfa241078954274cb164c45bccdba3d06cd026934f66a12460a3add2e6

Malware Config

Extracted

Family

sodinokibi

Botnet

15

Campaign

19

C2

augen-praxisklinik-rostock.de

pokemonturkiye.com

mindsparkescape.com

relevantonline.eu

kdbrh.com

ahgarage.com

rarefoods.ro

lollachiro.com

drvoip.com

rino-gmbh.com

powershell.su

eyedoctordallas.com

riffenmattgarage.ch

signamedia.de

ocduiblog.com

kellengatton.com

salonlamar.nl

nourella.com

birthplacemag.com

2020hindsight.info

Attributes
  • net

    true

  • pid

    15

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    19

Extracted

Path

C:\xn6cj-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion xn6cj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/85EB5461AB1897A2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/85EB5461AB1897A2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hInvpQGM69bPbJf1aFqVcAnKNpAzIYSwydo+wpy0SR8N9trD9HCc752i77iNrCec UT4fKAvHuSroWU8cXLhlo7ahBeNgrq708BzutSphVxMx8kv3ASuJ6vmtUyMK7LEl ljjHOxx2ANh0o81PsiTTJ9TDL7TKVxfTf273d/k/nzQRjOXc+1mXTp8EDl+lh3ga jB1Qhdam7tICU6fiwvzi3DR98chrAXi2t3nFGqoby9qi5Cqu1XbWJ6CXMC2ZmLeK FyHWu8GBEEmoEVBIsQfzevA0cFu8+vN27Kjy2AI1tZvLt32Mavw4xwtxW+plv/fH nXtyjYYuk+YcbvwH1RFGxDmQOBvhXTrt1nl/fT47Ad+/gl3VE9jpSIMvIpf4RQf6 VmF40Uq4bJmf9wgOi0TGWzBWuHYRi6RSiI2QclliDkaitY/mhk9Yz0Rbazq53Rsq sd9Ng6SnFzJTjMR4jXV0J6TVQ2xjtOQA93nNnKV5YNizpjq9L1xoit4tpTP2dAnv Vg0snRqgeuAv7a2sODKNSaSQk1f1H/1MDgZeuHeVN6qbJGVisfONOVryZmywJvlT YJXeov/pHTIUQJaMo3N6ktJApGCF1JLrhZklK2jQeOl9U9WYEern/OUiYcTKDwO/ ddhIrKg6pv6wDERDa7/qDBXI3PqZo4IyiXcZDR90mIgwOvpQcUhuqK9IpZnCX6Be LZnnLCA8tSYFqr1fu/clzzh7+703NsiKpDtMDhj1eQuBUitB93qVt3b4JnNGY69J Rb3FPTF9A4PIj7kdR5qCRodZhV5asiXr8QPkgpQhCJi9psJa4gUrUWUNAPKTcAlE 3pitRt/0AnHIhIoUwmgdOSQ29h9i9srhqCThYmcmJ3uf4tWhn21whJJE+2JTyR1U 5yTVvAeZDRPSW9xRYuDQyx4U+uZW6252eJKUiK+Ri8T5GkoI7FE2VfhVQGiC7MKi /GEWfber2S5+585F6T33CvRyiWbGgEyKC1fHiifQG514W55djK0T8C3Jg6qFHMGX 6Nr87UWc2r5XzY7IkjGgSSSTeoqGHGK987r6oNPTgQLBWk1tdcAn9Ff/B6/EzvQj rfRZY+zboXf2UUz+ZXt9tTuqnFCdtPV5wlCLPP9klg3lMse0RviHdhcFHY96XKni zw0Ff2sH Extension name: xn6cj ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/85EB5461AB1897A2

http://decryptor.top/85EB5461AB1897A2

Extracted

Path

C:\h5dd91j88r-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion h5dd91j88r. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9654F9AF342C5545 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/9654F9AF342C5545 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gMFW44CNXMMSB9JqekxVe21V3h9E41sUdEIUVi2I0KmaDx/V5RjePZCy1i5Y4Czg S/L6jMn/tweVMlD8HkeTl8Z4kXvrr4VSgWZtA4IAUlDGV/50QgjFgKhrQOZ+sBob uYnVM1ZF9KEDDKeK0Ps2sCFqJXlRa1GAIX+XrzpVSvV92sihQYxmAA4EDz20vVRd 9fnlnP8z8Rgobs2TEsRVweeE2p64CQn7xFvaSGEaV/R3/dfUoXtTtgfyQXx7IEzb 80T/4oHCJUa2OPrga+pNSFPufqZWnVx0CENcLB5sJfJVWu/zCk25OlLqRL2pFO6K QO8F78xglw5EgaOO9roDa1cwG3/4CqvFPO5wbmDRf3wV/sj/wA9qPUBU23W6uPAW ojfPQPphxc16i5QhFevp6ffCCHk5pz8BM+IyCzzTO4jqsqKkxZ7u8oIKOhJo/+TA n1PH0UxR4QoSK53fL78xNyltQR6ODshigkr5TjPnOdUldGMbmWmdAGBIxNRR5GpC B+x8FhfG13xavyxg4/ZHde69BGK6p08Emj4m0Gx7suegAC5TuzMu1ygIOSLZPHrm ysOhlUZANFg/0W0FQ0Jh5o+Ycp9ynKRJeKm/U15m0oCHlc+hkfDWUCwSz/ldeI4K e9FJcignaECpIPJLvS1LonlxTlIcf/b4fb/cebiu7qziHst7edlMWeOaxHeIazEE /UCvy9J4WtWtA1WbKWHTAIoAtXOoHLgYrC86lJ+IkHloME+zkpsja2Qr2WVIeQJx oFZDzsUohKE4zCAX1OL3nQge5hdP9OH4T0WmNK43z3HXIMKTgUQ6Q4lTQfwwVhjq JFDnPlkN25160qkcqPFMkzP1YarKurn3XKUsl7tbbbncfVngMdzvnovvjFQv13eO jbj/GVqFT7fgBuPhbGb7CoJQgleW0hSOBTKurcsx24dUHOYO2Mbb32VpRfK9iGfA +zGBs1aDLXS5z8If625Se6zvsFzIsDZG6OF5wl+PqRd4GL/re5uHgfT/fVT9GbYt Nb0MvdbqMjtAhPn5nd/aQeY2cY+STET9Q2ORq6sdHuqg2oJDjW8WWgIiZT87chOf VSV03lAR3eY4Qcn+PSPY2OAEUKs3Eq5jKxwCd68aYErYiEwIZhVrTFSho3ZOJMYa Extension name: h5dd91j88r ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9654F9AF342C5545

http://decryptor.top/9654F9AF342C5545

Targets

    • Target

      2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507.bin.sample

    • Size

      161KB

    • MD5

      d599cfe7691e8499941d7e4f0d51616c

    • SHA1

      843070b5c802a5dbc9afbbdf03ee1153f3249165

    • SHA256

      2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507

    • SHA512

      f04a3e88dc69641e0682d6e74a7ac75f80e06924f3d25987e74674d9dabac040a70164cfa241078954274cb164c45bccdba3d06cd026934f66a12460a3add2e6

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks