General

  • Target

    srnmp.exe

  • Size

    910KB

  • Sample

    210504-6l2eszd446

  • MD5

    18786bfac1be0ddf23ff94c029ca4d63

  • SHA1

    3c2b0dcdb2a46fc1ec0a12a54309e35621caa925

  • SHA256

    1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

  • SHA512

    49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f

Malware Config

Extracted

Path

C:\h222880-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension h222880. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/40209BEB31CD55C9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/40209BEB31CD55C9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: UYh8Mn7YtYWT4B7MReDCtMLnva6JCDkhF5Ut97C4SOlCbDooDJwNnPR2Av6KT4Ll D2PCZJ43Jy+GZp4updiKy0V9ccQu7mCgWd6/MSBsMfAJX0AmXK9rumYzzh62Lsfu dtNtVBfEo2nlofhiLoaRm5jlNBQ9fHn0IUOwVujCHINS3SSeQ9uzft1RLRMEqDun vIKs4aLsYAoOdysWLN7fedChwR/oeuOtSVJiaYn5tZUbkZGeJM0aHSPMXb63++M2 BlYY4eG3EMGCv7Fz4x1zk5cEGv9OhUXYuEoDSv6qciSzzvZAENzW+pluhnJmjtxa kFmMJNonZWc/N37t6GQe33BATDVIRLDFTO4JPUYiL3ShksntaQ8EHCjNJGQqs4ED ZsU/hA0lejPM8+LYrpltZ2AGbAaEXpp8arJjPlWhMisSz1V2nuLW5fx8b41nhasg Z7w2Grl76uMzpgYVhrZD0T3h3NNwyiwbzYbtznLEjFQg+PrPm09Sx8FC1klM7/3O ty4+H4QhEO8UwVfiefozKvR9baNm+xopjTGu0A1m/AKf9oDV73H3/8ul9qsMjm2t OORJCuMVWx0DHn+upEvR8FtXpj5iUYzjaBdGJGxvlEjaGxznVhbkRBaxXlmIjouu ret12ArcYBYmbOFDgt+DG+1AQackt5Ibox8AxLc8csv1748u6cYz+TpYSUSIdvCf N+y70Pvhl+H9QnW0lH0RXT27UUE/p8ZboDPgkRrD5/b2F133+51XzH7ariBOzFtr eHK7onZ5+0ROZj2XtzwUU3GFGVu8epM32fOJJFkrFuKcU1t/4D/IGOLhsJHTTfzY SfDP/FJo/z8LwEcY8dA9WkIZVzjHEDJ0RuaHyskuElxtd1yVR657NVm53CL+Xfrs dtfUa7ZsT1IdIxIP18aBpQ2udI2+LCmcPdsNFC4Dj5WBhT+e0QIP4tNk83DBRqEY lk9LfPvfAN4dvlXbS7eOujkqEzHx68+bHhSGp/mkYUirdHB3BntGGOdTFY+DJYYJ kV0LdBbdXTCdLrznjtaC+eeHuWWOGjaCVjNFrv4pbu3YpO/gk5ZfAgxRWo+ZA2ff fXohZJU0Bx4RW9rYTCx5V5CiauWp8JmluEOKZhfkY7JT1azr4HtjccJYLpb9QsJ3 AqsfOPajWEp6k0bjh27uoLUaRlwKQvqOWlSrA83Ik4P7r8E+Z2vMNJKa81akvWjd V52jtMr9qeXH7xOVkd+Ds6yo8NR1Rx1oS+oh5yAbunuhLG7zlblxHustgHuStwdT n9k+YDGAbafEI69ChrcXdvBp70W0bV2Y ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/40209BEB31CD55C9

http://decoder.re/40209BEB31CD55C9

Extracted

Path

C:\a85oz-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension a85oz. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/309310509A847E62 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/309310509A847E62 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: jV6T0KiH9QDIbD3DG1Vwd3XbNT4Fzjmp2wzNlpEbQFTMYk2i+Y+5nulSlE6j/ngo 09XaP6MTv3u+1PQ4BUvi2Lghua/DMEuFPGVM8JMvkC8nhevrpXYmrvwHLDE893Pb KP784N7emsI41QMrkOBjMizYopTlz78NWS9AEpdeOgK6RlrQv0bLJLSPYqD0xPQD h4hFhxyE65gB2V7Y7dXYEOon6anjkCzLU6oECSlU2mtbC9giqGpdBi3zTE4qhxK6 C3ZN3aG6V28NiMxlpRuOqKPa8RdXDiYZOcZyA2JVlJb75hiOuSVb9hhXKhwkM3/Y td/eNBP1a3xNRehvcp18vdXJLz++BjS9/xze9MQG00A05pGf3AttjnqtbQCISZTW ZeC3NTW99f4b+y3xmJlLyEqDuiaOCX3CTWLOpTPcLT9qfbyy1DFAL4nQPo4OHELx n+KoepDo30jqUdKjdioJ9WNY0mCH8VoFGbMUaN8Sso/XIB2cGNlTRo9YJ7/5tBwf e2E99jm8JhdzmfqfFyicoEpy3Sb4kckkzbdB1sO5shuP+IuAcMPa7i2TCymlAGW8 nZvwRRsKiWDT5go4HNXbCiIjXZvrVZgxs/7HmdNK8QvdUtL9Lpe4p0y9SbQjtm6E lZiTlEumkcJkzjPI/ONNQTNkgf/nEn1aZ4AoV7cZhOo5QP6t65o8btHGd3lhaLgJ 1ORtczD0DJOorEO8mJVbLX8H8KELyXGnuUAk5aVf+pFz1YN1jqkR+6N3dJNC+95p 0hR4f6wr2ns27CK80apWni5i+6leZg3IOAE/rCovmeuexryT6voymh0LMurpYLZf 1aCY42uyFu1lMYaRiEb2hJx7pBxMrifR6+NqeGFQpWnZmE5/PAIDeYkrT8UMD08W N3wuOeymRxHx5OiPki76Y1q4iqOndvKeaY8AgNmfrAd3o52MhLljrlWmBoigg1Up 6e0VZZx5lurYbuu4m4DLU9CLeZs2qJKObKKP5xdgl4wlf1IcXYF+BQM28prHBVA3 r12iJHnV+PdRd6Em1V86ANV/09rrG1Oyv7vZSqhm2jbj8WQOibFLMUEBEUvtkrzO UJ2rut37meo/1+nXrmWk+weCPEtQt6zOHBZl+5VMHk/X12oIeCv6+J4iDbQD7AxT 81UcwrfQ4dlWTZH7EhpdVquQkVg+0A0oPybgzFfEKuJsId/ENZzfqAG1OxoU6hcG 4i4wTMiqOm/ztIxkrM0utNmag9IWOU3L7drCli7GrUCkVQEMplzUkRz9RySdLI2l ihWZqw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/309310509A847E62

http://decoder.re/309310509A847E62

Targets

    • Target

      srnmp.exe

    • Size

      910KB

    • MD5

      18786bfac1be0ddf23ff94c029ca4d63

    • SHA1

      3c2b0dcdb2a46fc1ec0a12a54309e35621caa925

    • SHA256

      1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

    • SHA512

      49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks