General

  • Target

    d599cfe7_by_Libranalysis

  • Size

    161KB

  • Sample

    210503-4htdkxr8p6

  • MD5

    d599cfe7691e8499941d7e4f0d51616c

  • SHA1

    843070b5c802a5dbc9afbbdf03ee1153f3249165

  • SHA256

    2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507

  • SHA512

    f04a3e88dc69641e0682d6e74a7ac75f80e06924f3d25987e74674d9dabac040a70164cfa241078954274cb164c45bccdba3d06cd026934f66a12460a3add2e6

Malware Config

Extracted

Family

sodinokibi

Botnet

15

Campaign

19

C2

augen-praxisklinik-rostock.de

pokemonturkiye.com

mindsparkescape.com

relevantonline.eu

kdbrh.com

ahgarage.com

rarefoods.ro

lollachiro.com

drvoip.com

rino-gmbh.com

powershell.su

eyedoctordallas.com

riffenmattgarage.ch

signamedia.de

ocduiblog.com

kellengatton.com

salonlamar.nl

nourella.com

birthplacemag.com

2020hindsight.info

Attributes
  • net

    true

  • pid

    15

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    19

Extracted

Path

C:\6e1y1v9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 6e1y1v9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6B44EFE9392B6AD1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/6B44EFE9392B6AD1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FpDxUT7KyR/Fo+NuprBJoPKI46Ainb7joPW+yozxyPjY9yhWmqbk1JrSfli3viqI pXbRN27/7JbEe5IHU7HxH71YTeQ9a7w5B6velEUcAGOyT3cm0AA/S2ZdtlRw3Gj9 yNy6slXZwpyMIVPE4aa12fyLZLpPjqdl7NfjElXQq8NS0qXdZWbYZtY3ia8j4D5r kOOuMeWuDiBxsnvM0okfR4jd1RMVamJDgTQIaewtuH7vLbg6hf6+Py5WiF9R9sJj WaY4HkPm+TfBQdLKVCxsMveN/+fJ29AGRjuwTdGkVWmlZnVa7iT/TCZxt50BCRPx /Adc6hRIvwzW71ezzTgo9Rk4QXn0P0O4z6Gah05LVQc+cIX4aI+KyKncDXjEqTTp d3fGdaKQcK7FYgcbIGLcDch7xHRGK7bLeeTtvWoR9Rbz6zvTn7zsQ2tHdx0mv/OR Sy54OGOG/6KjSdI7AR1FJix2mBHpcmvblmRed1zgwL9/qP8UuvZ4kyxES4hpGoNa fPGbT3Pxyv0n1uac1ZKnuo+kdVT/50Kd++0pOHJJB9WlBYSaE0ibaCZM5mnH96yh qdscRAHqjvDidsvQWyF8rkZkorEeOA+n2f8un0U0tftUQOImew/yjehlTAtsNSX9 Ot9fOm+LL5p0RNuwIJirLF7QfND3EHZXIb/w+Rao0NpxIMpHZZRBe68trQuWO6E+ joCNGw9/F1UamjOSwuM5TTdTdRfY6YpguL/9SsDBSmi3Jtok4GH+M7FB4n4ZJ8Xk x3nVdaH1q6MmCNK3GKBvUzfTlWqGTWAX+toE/Cvs/GIdGmFWQZyb1kha0VDA63jO dUcO0BQUf61Ti0OwzE0lWTs+1+7PPBgauuCxr59KtwmC0b5izK4F0oMWttyOexqv 8AfcDq5oPSxuTnZBZxk8kE9RcdLxdR+kZMe4zvVQdyWu7aar+G5jMfohbG00FKj7 faTxn7emzeEpxldjdpzcMLk9AEz/Tjl4yZ5P/gyFQN0Ah31vN7cfqy5sS1dc6XLK +DdefCuHHF2BngQPv3q5q6mPRjI8fB9xW0sEQ8TOOxgdI/AorhHrGooHkzIdmbZu rXjhp+QMqIHaRRJ2eflR8g1invLtAYA2JFAmLOJ5Hg31fiEIdKqT9ub8 Extension name: 6e1y1v9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6B44EFE9392B6AD1

http://decryptor.top/6B44EFE9392B6AD1

Targets

    • Target

      d599cfe7_by_Libranalysis

    • Size

      161KB

    • MD5

      d599cfe7691e8499941d7e4f0d51616c

    • SHA1

      843070b5c802a5dbc9afbbdf03ee1153f3249165

    • SHA256

      2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507

    • SHA512

      f04a3e88dc69641e0682d6e74a7ac75f80e06924f3d25987e74674d9dabac040a70164cfa241078954274cb164c45bccdba3d06cd026934f66a12460a3add2e6

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks