Overview

overview

10

Static

static

6f173aec98...68.exe

windows7_x64

10

6f173aec98...68.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f173aec9830677d751097483b2cd8b9a1609886d0c445568b6f52cf9461a668

  • Size

    286KB

  • Sample

    210504-1zyvd9q8z6

  • MD5

    07679969f48c4e0a83b9eb3ca31e9a2f

  • SHA1

    220c2c1b5b625e800fe6d5e72d8971f25310ef63

  • SHA256

    6f173aec9830677d751097483b2cd8b9a1609886d0c445568b6f52cf9461a668

  • SHA512

    4219272808502c61819c5d1e433e11bbcbfad68f5dbddb64c8bee257c15e09255f59548b5be3a883903ce053ec85774eeee978f459c55adf99654763fd17c28f

Score
10/10
sodinokibi$2a$10$7itkvtmjdvxw0ivrnlacjujgzlbaj0dwhdpelrp.av6ol8.svzphk4630ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$7iTkVtmJdVxW0IVRnlaCJujGzLBAJ0DwhdPELrP.av6OL8.SvZPhK

Campaign

4630

C2

qualitaetstag.de

blacksirius.de

caribbeansunpoker.com

heliomotion.com

galleryartfair.com

alhashem.net

rushhourappliances.com

slimani.net

wmiadmin.com

conexa4papers.trade

andersongilmour.co.uk

lichencafe.com

porno-gringo.com

dnepr-beskid.com.ua

tradiematepro.com.au

antenanavi.com

hebkft.hu

mymoneyforex.com

manutouchmassage.com

y-archive.com
Attributes
  • net

    false

  • pid

    $2a$10$7iTkVtmJdVxW0IVRnlaCJujGzLBAJ0DwhdPELrP.av6OL8.SvZPhK

  • prc

    tbirdconfig

    dbeng50

    mspub

    ocssd

    encsvc

    synctime

    sqbcoreservice

    ocomm

    firefox

    ocautoupds

    steam

    infopath

    excel

    thunderbird

    mydesktopqos

    wordpad

    winword

    outlook

    thebat

    visio

    powerpnt

    isqlplussvc

    oracle

    dbsnmp

    mydesktopservice

    sql

    xfssvccon

    msaccess

    onenote

    agntsvc

  • ransom_oneliner

    Soon you may lose your files FOREVER Find: readme-{EXT}-READ.txt in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!

  • ransom_template

    Your files are locked due to a vulnerability in your system by "{EXT}" extension. You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly. The only way to unlock your data is to buy the decryption program. Go to the link written below to more details. If you cannot do this yourself, find a data recovery company in internet. They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees. ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE. Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move! Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the "TOR Browser" (https://torproject.org/). If you cannot access the download page of the "TOR Browser", then download the VPN! After installing "TOR Browser", open it and follow the link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}

  • sub

    4630

  • svc

    svc$

    sql

    memtas

    vss

    veeam

    sophos

    mepocs

    backup

Extracted

Path

C:\readme-70j8b7-READ.txt

Ransom Note
Your files are locked due to a vulnerability in your system by "70j8b7" extension. You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly. The only way to unlock your data is to buy the decryption program. Go to the link written below to more details. If you cannot do this yourself, find a data recovery company in internet. They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees. ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE. Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move! Go to the page through the browser: http://decryptor.cc/F3EFC38798675AAD If your site does not open, then download the "TOR Browser" (https://torproject.org/). If you cannot access the download page of the "TOR Browser", then download the VPN! After installing "TOR Browser", open it and follow the link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3EFC38798675AAD After going to the site, enter the following code: Wt3o1+yyok/x5fDfHGcyo8tqbaaqBliuuZc1+i8At1TmfOrU+W/Gh1DTYzBn7ciK oApFN4QFU+Qnl+NvOXoOalwnetLJSr5Vl/H4OTcW2Fu89TPnI/BSmRUSADFh9cDl tQdLHNm9a9tdlN8ttegi/nIOQrTzy4alNLxT9AFEZP86MgvxcKFv1HWpYzUKVUbe eLHLkTxWbLvp8920l+NlZ1Dnr9JJ6VsR9XsFgTBLwsRUSTruQ8mIFyeLucTbV+CK TLtmiUUag2nkZHWaLSjkpWqkBpmi3ZPK/LIoNamJHOS9Lm2eAj2N9LyF18PSpVf8 +f7bg6AXT9aoDyFcAkO9UbVj76AjGWDPobMt+/MTw7BmamvByiXpWflpkc3EJ5+6 17dNEU+CsuBzgE1rr6blizqH1a/5cYQnmx5wbYLVZdYxMyOkTOQeZabmqHeiw0KL nZfVptpAC1DBUms2ju15UyPgxRMLwbItzzbVRBGncepW9Tc9cyr1CWMExV6zHDzJ lptT2KilRj7ZXvM+CJReBa605q4/xhatSB9rNGfSboXzZJJACt3wA19pK0u5X7qJ zHgW3r+g5bara1gzcNgI5mmCFo+uqwfIqqwzzf6YdSTmQtLCNTQHKZFOKG59BMRg hJ0hgQsIdjaPwhKbWlx8auBj+L7RisTLjIbSwQnvo3ts67iJapWQMMJY2+BWy7xX UINFtappYiH09rLbOzo8HGqNPgI+3YEV3fOp6MXw6ly1qzWyrjBMqXiEbP3c6K4U 8SUYsT4FjJ90hpoxXZdXTxa+lKS8hrytMtNvJF6tbRgeUYM/jTPQZelnZFADJs5O L1T99xoW8c9cqcwjfWC5SchW4X/bnlYGGWRJV1TbiNLJ6aSMkB0IbnXSFMx//jgd 5YAc21yKgyBPmyDOqAWaGt5IYB+HYJa5oiT4WKQffnTN27aXLghNYJRffQ7R61y9 FrLCIdiNEV3rCl12vR0ZcsIqQYpjKDTdk8jOu9SngC5LsMo6w4y6HqOS7K6CYaqM bYN0F89zaKmfBHL/pbkIBk4fLC/40lwCLRl1T2ehmY5Px2x5POx4Ss+oweRbrmq1 UkbEJUTJi22jzSd4qht7t/D1LWsgfIQIBbwQhlN8d4JqaFHIX71TWBjQaCb3pkVD qI5GVCq2MNR1Jnbv6qThe3XEpEF6V1aA5idKIw4OwpZ7XhrAKCpP62jtmot//hf3 b/xSaUdI13+X7HP2EMslDUKCS3hCqJ2WsUZ8MFRaj46BS1/ddEcCYZfftmRIaK1h 7808bLKhaUSZkDBNjhHCkg==
URLs

http://decryptor.cc/F3EFC38798675AAD

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3EFC38798675AAD

Targets

    • Target

      6f173aec9830677d751097483b2cd8b9a1609886d0c445568b6f52cf9461a668

    • Size

      286KB

    • MD5

      07679969f48c4e0a83b9eb3ca31e9a2f

    • SHA1

      220c2c1b5b625e800fe6d5e72d8971f25310ef63

    • SHA256

      6f173aec9830677d751097483b2cd8b9a1609886d0c445568b6f52cf9461a668

    • SHA512

      4219272808502c61819c5d1e433e11bbcbfad68f5dbddb64c8bee257c15e09255f59548b5be3a883903ce053ec85774eeee978f459c55adf99654763fd17c28f

    Score
    10/10
    sodinokibi$2a$10$7itkvtmjdvxw0ivrnlacjujgzlbaj0dwhdpelrp.av6ol8.svzphk4630ransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks