General

  • Target

    d599cfe7_by_Libranalysis

  • Size

    161KB

  • Sample

    210503-p2asval64s

  • MD5

    d599cfe7691e8499941d7e4f0d51616c

  • SHA1

    843070b5c802a5dbc9afbbdf03ee1153f3249165

  • SHA256

    2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507

  • SHA512

    f04a3e88dc69641e0682d6e74a7ac75f80e06924f3d25987e74674d9dabac040a70164cfa241078954274cb164c45bccdba3d06cd026934f66a12460a3add2e6

Malware Config

Extracted

Family

sodinokibi

Botnet

15

Campaign

19

C2

augen-praxisklinik-rostock.de

pokemonturkiye.com

mindsparkescape.com

relevantonline.eu

kdbrh.com

ahgarage.com

rarefoods.ro

lollachiro.com

drvoip.com

rino-gmbh.com

powershell.su

eyedoctordallas.com

riffenmattgarage.ch

signamedia.de

ocduiblog.com

kellengatton.com

salonlamar.nl

nourella.com

birthplacemag.com

2020hindsight.info

Attributes
  • net

    true

  • pid

    15

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    19

Extracted

Path

C:\3m53gkg0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 3m53gkg0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2882DB172660CA09 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/2882DB172660CA09 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +xdodB3Gi0Jr6rGhQbrqVMb9Jp97IpcAFRBg2+7LhTtSogNsiuIIBVTNUhQ2Yy2Y czBgu6RfK0crE2pjx+q2dGnCDQ+YCOklxRoaVMkh8YT9uL3obpEuAV59CmPAyngN wPBgJKtCLKvxvaHkA1PGw+p7gnq/cleCvZEZCYdKB2N8s+JynmHtguDa054WdgfQ DLDVYoC40A3w9lnnGNtGX7IvN5Y6QaJtSiXRvhflsmQVTW43OAyqSlq7TFtrPk5y 7+PRHe9PGhujNKQMUqRALDBkL6c5R5hGiLl75+UjPDcgrUdkho7ZLXYTArRPrIb+ KH6coJ+MR3YDBR/C5VwlmFxeYiyVCX8ac0ZrFonra1GODASr54t6W9QkZNfSk1/y QNWz8nZXoIydhyIZAaEegXMAmvAo/cmMtmolbLqdukBwKlFO4TJPItfKO+R5plcg L9KHrSnLLobMVMUx1NyIpCRmpbe6knBfp/HuLf+vt1f4MxDTfXdz+PmSgiR8cNnr fmRAtc90LW10OXJ6k5h/1yunp40TXfTaOBxiHnSO/rCE+//G5/ZZQHGEMazRZjui nxwiGnseuY31Nl3Mes+y5zKBb6puXMDWijyzAjhL4YMnpPAMptYyzHhAbdBwugTm DtvcFMuyYqMicrMZI3UD6dDLNf7AeevofYwkSTF3VTt5DHz3kSZN1nB/e+JMb/Tu pjWddWBU2AYZr2cjGCNaaTZpZt8LpSzUzn65d1Y1nopi94KbocdDuFjPFP5lcyAu Opib0sARqpS9IyaHps+VohgYknxPaNeh2Mz0Fug3+TsCc/0ppCxp1h2AUZ5e4OQP Yy0onhQqlALRXyCe4hPINKb+LzsXdr2GYxlaRp0wp+KHprHKgKNg92Hsa3uPePHT YLp1A1dcn5grQEEfx/r9ZkYCj2opuHOMH+t5K8yAucqwxXyGsLz0bLpVvirEhme+ ENCsaaUuA95qbp4sf32pUDs7OxxptxhZsswpSupK0NlAlQZU7fWmT80XfbJ+byTf uv2pyKjV1MH2q5deEd2DJUQLZcSonARN0BNNaS5kwMt36KJ3OMFKk1+qjIg4zzZ+ ZwdD8upBgwIL3SdWor7Ryz8RjjsT1BZqOnSfXxVbGdTPqMfAs0o5l5I/L0Y= Extension name: 3m53gkg0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2882DB172660CA09

http://decryptor.top/2882DB172660CA09

Targets

    • Target

      d599cfe7_by_Libranalysis

    • Size

      161KB

    • MD5

      d599cfe7691e8499941d7e4f0d51616c

    • SHA1

      843070b5c802a5dbc9afbbdf03ee1153f3249165

    • SHA256

      2ea781140f7e86c63b636249b5fdba9828661bdd846fd95c195c5b986b84a507

    • SHA512

      f04a3e88dc69641e0682d6e74a7ac75f80e06924f3d25987e74674d9dabac040a70164cfa241078954274cb164c45bccdba3d06cd026934f66a12460a3add2e6

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks