General

  • Target

    3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad

  • Size

    722KB

  • Sample

    210504-bxfyqaxrkj

  • MD5

    21e25d30d4258366c12f76cc1b534fd8

  • SHA1

    0c77e2d7c180a7923e7c1236e1f758cc9956e939

  • SHA256

    3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad

  • SHA512

    e5a71460c262b378993eca9d2c0be6af3aeb8a83e78a0bee64e3f90013820fb6ee809a270c34675e8abb79de45b228a8572d88a4a71c013e04e5607e2b48b53b

Malware Config

Extracted

Path

C:\e8h7w-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension e8h7w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We downloaded more then 60GB sensitive data from you PDC file server, include your clients documentation. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8FD7A59706A4C1F4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8FD7A59706A4C1F4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: o+QvG9UuN6L2LyRXO6cluQLXXPs8S6U8Cv1ySXTH7B3oUbDuU3KP700S6eNKDLHN SOyl9sgjgwkILF/b4hAJbbYYhL7YIiRX2KtfzgaP6Kvsbs/o4IjdxNYtR8nibuPd JR8arRc1+gu+OzWkD+kRS55Wh78GNw5+BeUHTmELpyUU52d+JgdoC4mdiZp4M4i0 y9bDB4bcBiGOSp5q9PeOWbLfnjoAuywj1jrqdqg6WdQ+KSGUMk0jJ4G3jg4n+wfx 1YnNrwy0pRU3xUHamfndT2MFYhH01y8H5qFg0oUvPx8vG6hQgfGUSQsZY6vtoUtJ PyUl4Eea2hfp2ekobODAK9mcOikd7BiB4vOc5/Q0rE6Eb6xxGumRci2MUuWpMnyL K2kIv2WjOiBkWken0Z0FSqsy6EWCJYLTdCclbykMUQABd/s/zjGcMjIGvqUH2z0y mF9I+pKyxZ9frrqmyFyCqaeE6FMQb7XkWIS4xjXncGUbVv7GfDVue7cKCWsqrTnj 8iFZALbBlFVNI6hqO9iHv+gZgHSVSfK1i0mMIE7Fto/iJh5087heDwg2JHdHSqw6 PVUNZs/uBcjN/kR15YTGDwn9fqS3XZBjNKsIawK/FbTbLFIO7ipwbT1wZJ4TtvvU sxuamQs4EgomTclVI11qm88FqC57TgBXqQBFd19JH1UuUO6itaVwRkE+zcVcYBaH e2K00LCqnAWcFPRHxmq15nNacDdbXL/M0G9IgJDpANV2kvkjHDkuLvHPONpDvbX4 Mt5bgOnZGZFLVJyU1U5GRDgZZDfB96VqDt6Ca4/C6jaZAEj6HiHC+eSburzl47Rf DiiuXg0UCfOxYAuM6WPLEk8jE5mxKagm/s/L/VlYYMtQwTAg69w/h4QvwkdWG3wX xbgi8Jk7DoxHg1FWLYPrrfPX0yDc1rI0AmAMfOjxXiH6qkvpSK0kFodzWX3GG8Dl yIqpgSSj5WCs9yzrt5yCK/S6fObB9Z44N/XNZZrzWNFNyUd1S6M0zfdKRfJtSdAt smdNpxf0BoOtxh1+bU9a7MBQdK5ozKupkSmeNlyQUFvj93/XV27sn4oV7kikwiQB UdG7nqXthOfVecVJi//TLVDB45yoKsnGmzKTnMAKTNJ3b+J6jiT+XXJEzHixqi59 02qxEDyc4Iw4LiclDxvb0SIiiBg/T2jQvwGMY6xBwiu2e9tlYbLSAsms+N+CHJCh IqHyJDnkG5y7+fZUc0YoME9RAZ+VVA1JTReyYgy39Jcf+VQdt1vbD+UhEVIIsPcz lMP1AjsS1lYDQvf7gk4MS3JcHbmDJPxpkf8SqUbr ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8FD7A59706A4C1F4

http://decryptor.cc/8FD7A59706A4C1F4

Extracted

Family

sodinokibi

Botnet

$2a$10$sfGomAv/vdodU1RKLqi.CuDzf5dyENYjxjvACVad1Ng/Xv8SwQgti

Campaign

6420

C2

tulsawaterheaterinstallation.com

dnepr-beskid.com.ua

wien-mitte.co.at

irinaverwer.com

webcodingstudio.com

waynela.com

yousay.site

vyhino-zhulebino-24.ru

chavesdoareeiro.com

brigitte-erler.com

huissier-creteil.com

gasbarre.com

twohourswithlena.wordpress.com

streamerzradio1.site

lusak.at

centromarysalud.com

xn--logopdie-leverkusen-kwb.de

troegs.com

boosthybrid.com.au

employeesurveys.com

Attributes
  • net

    true

  • pid

    $2a$10$sfGomAv/vdodU1RKLqi.CuDzf5dyENYjxjvACVad1Ng/Xv8SwQgti

  • prc

    ocssd

    isqlplussvc

    tbirdconfig

    winword

    dbsnmp

    firefox

    mspub

    mydesktopqos

    onenote

    ocautoupds

    outlook

    ocomm

    powerpnt

    sql

    wordpad

    msaccess

    infopath

    oracle

    visio

    steam

    agntsvc

    xfssvccon

    encsvc

    sqbcoreservice

    synctime

    thebat

    mydesktopservice

    excel

    dbeng50

    thunderbird

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We downloaded more then 60GB sensitive data from you PDC file server, include your clients documentation. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6420

  • svc

    backup

    memtas

    svc$

    veeam

    vss

    sql

    sophos

    mepocs

Extracted

Path

C:\p5651fo4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension p5651fo4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We downloaded more then 60GB sensitive data from you PDC file server, include your clients documentation. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D47985DD4C1063D2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D47985DD4C1063D2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: f5zXfq3PhtS0TidAHJKrE7y1Mkd7+tHWwVF2BGA7mGi5XJ/ywO4EhUoLsrkwkMbS RQOmpZDYElXCclZjE0J2kcheaVUmblPMDRh98zEcO87bIQ155Xr5bRheO6oWBrax INSfCFb+7tvHY3fc+Sjv/sBUPnwf4TAOBp7dOk69JcaA7fw6/VMmjedFEJoF+HgY xNss21SWAlNdYdulPfWBV9PvWrwGZBMkON8gDoihGJ7iDk8o9giIMfMAzPLyfNwV IY8N38rzSZgRi5EqfTthpbVbeGKRLE0Hzm35Ms8/26CubhYetTaO0mWNZIGVIkpF YJFjq86K7bCyAEM3ffizHpIp0NXVzhynHJouGNRL7CljLVw2HgmETjD995se6PuI prn8h0Ho6w5tdNE/Gm/MgyKG+w/yHuSjkgFsYZ3jqyIJB0MNW2wTi40U6ki5jmZl a1d4F7wIj2OsAZGbZpUo6hgQnTlBvxihT6HUqiEQjBrNn2PY2Fr8JwC3JgMdXSqA QdlpS4WQfyJxIwjmc1xmHfkw3bJnlhQLhEO7+JTpqqyxg1kjXFvHJjOKWeSrsclt K/FYgBqIt0nyBT/ZVwQrraaSpwK0JIi7og57Qg3yFB0S01KiP3Eb+K+RSFk3QXRH ak1GWNFt4P+sjcGgW34JgPydZBxl7GKclZAphK3/T6V7e4Iemk6Y/py5C/nhSSHD X2UTx62AK/7f5tbVp9Tc2kAVCaI/DWOeDhKkAFCmnEfevMElhCPaUEqxLbCeBNlY 4VKiqNcmq6GnhrILofBVrjwLaw5t4XoPEuiM1vChn/5CxeNpKGrX9vxFUfo89loa semHh1fpe3WoD9TA+tHiw/n9aMFcq/3K8cwIXGsQy8x95+S9DBEPbo7SK9VsN1HK uF0a3pwmBy6vZuUruLwztBKG74gCMafbrYia0DFxTNdXK1eE3Ce9Im4J4ZT0plbS eSU0JD3xa4ypVqGM0m3VeR2wVyyN9jk0MyayJYwzFiDa0P/L9zJ9kXk5UIJfh2w/ 3fbMQNhCHDR5vnjSxdYmU61205QzhD8gejzbGLoXaBdqzVzY9aV6YmTw80XyCI3V PgpEnp8/I2a6n9wbTaIx6tu2ZjewPgRgXv/lm+RfG21+A9rQW4WBtRKqL9upuf23 NjGlSOvLdXoPegrtvCKvccwZXNaaI6XSY2UmCSSHRIa0VZLskbPdlgDQpbGVUfDJ sSyZC7ILTikTvdSic+et5Oq9oaGevhTfhMqYG9c5AoruT6PAvY3gqDg8DcVfceEY JJe0dwjx/luCEVomUx1wN7aoLW8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D47985DD4C1063D2

http://decryptor.cc/D47985DD4C1063D2

Targets

    • Target

      3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad

    • Size

      722KB

    • MD5

      21e25d30d4258366c12f76cc1b534fd8

    • SHA1

      0c77e2d7c180a7923e7c1236e1f758cc9956e939

    • SHA256

      3c56d3fe6373d5b84074f214b883ca65685d04141ff829f73ff65531bf1f86ad

    • SHA512

      e5a71460c262b378993eca9d2c0be6af3aeb8a83e78a0bee64e3f90013820fb6ee809a270c34675e8abb79de45b228a8572d88a4a71c013e04e5607e2b48b53b

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks