Overview

overview

10

Static

static

8ab5753e0d...60.exe

windows7_x64

10

8ab5753e0d...60.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060

  • Size

    229KB

  • Sample

    210504-c8zf6rg7ex

  • MD5

    36d5afbc2394fb007541d82c61cad41f

  • SHA1

    b1e328dc8dd37aa7fbfe50427a6633f5f077c46a

  • SHA256

    8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060

  • SHA512

    89588e15274d0bfb1d2d74adbc62be05a30faf1f040f3e4cbafe7913ad014661643b1bcdbfbe4f8811bad9f4f88fd6f41630d694db43b5bf6c54b576d4a9de76

Score
10/10
sodinokibi$2a$10$ceyzqhh6apyg.fvmd5jbq.efimza/mzoem/ogbumflsf73mqre0m63597persistenceransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$ceyZQhH6apyG.FvmD5JBq.EfiMzA/MZOEm/OgBuMflsf73mQrE0m6

Campaign

3597

C2

ziegler-praezisionsteile.de

saxtec.com

ralister.co.uk

connectedace.com

antiaginghealthbenefits.com

adoptioperheet.fi

fannmedias.com

appsformacpc.com

vorotauu.ru

spinheal.ru

mikeramirezcpa.com

tomoiyuma.com

bayoga.co.uk

celularity.com

zewatchers.com

kalkulator-oszczednosci.pl

amerikansktgodis.se

toponlinecasinosuk.co.uk

elimchan.com

foryourhealth.live
Attributes
  • net

    true

  • pid

    $2a$10$ceyZQhH6apyG.FvmD5JBq.EfiMzA/MZOEm/OgBuMflsf73mQrE0m6

  • prc

    dbeng50

    mydesktopservice

    firefox

    mydesktopqos

    ocssd

    powerpnt

    steam

    thebat

    oracle

    ocautoupds

    onenote

    thunderbird

    ocomm

    isqlplussvc

    excel

    winword

    encsvc

    msaccess

    infopath

    visio

    mspub

    synctime

    dbsnmp

    agntsvc

    sqbcoreservice

    outlook

    wordpad

    sql

    tbirdconfig

    xfssvccon

  • ransom_oneliner

    ...ALL YOUR FILES ARE BLOCKED AND CAN BE LOST SOON... Urgently find: {EXT}-HELP-NEED.txt in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!

  • ransom_template

    Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "{EXT}". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}

  • sub

    3597

  • svc

    backup

    sophos

    mepocs

    svc$

    veeam

    sql

    memtas

    vss

Extracted

Path

C:\spr5yb8tz2-HELP-NEED.txt

Ransom Note
Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "spr5yb8tz2". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/8666B7D008AA6E44 If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8666B7D008AA6E44 After going to the site, enter the following code: Jj1mW1hCaFIneiBD0Rk1v0WDVknYddIweii68bE49AwCIhhn2PeowYzOPmyd9P3Y /L0P64BoePdEj0TeLUoxu41ptcEz4+nPls5mH00Cj47+bsWg+qeyQZrzVBfA1OTm N8vwJlPQLNO+6Ql38aZ6Hc35bwtHEGwlRIcK5wfzpKCwtVrs8xHBbMZVpcONBxn3 wIWWkz1sWi0QaU9sEff2n7Injm5Fys0PVV+PshY4NRTujDb+76X9QdOHHSgEyQbe ENeTzfSqtpCFGjqyjpJ/HR0ahuGTepG+qUxxrTN7i+dnyhtLIOsm2IZTXJM4frjM BUer6lZPiftb+GE3bro9b+Kh5u31ZtChYeFGLevnVvEym0CrgKUYVIPJ+ImhlBCF +sAtoUYQ6ml5DoWR/yMMBbNLf4Ta8re8dA9k88ha7qibJSpyTyGzsyidHq+blOdR v0e+AInYPbKF5AwE7K+JCDmab7rlYVYd6tdTUD1/EWGPMmEZSegNN8H5dkelylmc zj5ZdsZS7KgV9uPteAeZ/5xkamk4rzMYbf8nB1xbbuF0LslnZyXdG9KAXDPdw//5 +NxDw/nf+vcoFJEltP8YsQ8vpup0xURPpEVVOZkLOfqANUri5IvITx2gDzBt3DyK PJyWlGhz4QlK+urEbw+q1FSToxkLDz/SyR5j1dpFcoY+nYdToopVj/bNjT13sOvi 2L2PG8zAT8BcH88AeRvEV8fxiqYOHKX5ASkefbW31jXqtUsLPAEwmkS+nN2K1AaQ yYVlw+7QYMA1uex+WS1zCSQ6tzx8wv5q0kxJlULuZi2FGm8MradHMZv+rQMWwUOe tLPT+ZVomgtelVrGULji2eqjJhI+Q0KJsFP4uKRsEF3hqTwtote1nPhvPTKqX0yU NpcOTO61aWyJwHcs6XqsAPE05OozqWxflP50GB1CfeIUtLcnFb3JD3yAe+AoyHag uiZTtM+3gIdYYmRKBHdlpIw4E3FbfRVtcvl3CjHCfNzXBpMqxsNlm2wD6Htd2YxV WeEqwJLVKm5RuN8m/wzJXHLqGIe0TEIh1cBjsgDkXm0RE0JPSu4r44aWfFTColt4 zid1YVpdP1IpoLZKs1wG1dkxPBOLQVa9QqpncHmqv7cgKa1e1WCJvcNDCQOlJGS7 3/TFnebnV/tTRcu1G5IWQY2fn1nYSiEj2qP4CxoXcdWuDEOL9lyjdZ/AhTOIRW5J lwz3nNgYwvjdqiZeAnAKgnCaDvHqpgOKPRDQMy6XKHufaeK2Wj3bBkLCFvxdSTGv WjYnXw44bmBnSFxFENKELAzCZ4TkIEnU
URLs

http://decryptor.cc/8666B7D008AA6E44

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8666B7D008AA6E44

Targets

    • Target

      8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060

    • Size

      229KB

    • MD5

      36d5afbc2394fb007541d82c61cad41f

    • SHA1

      b1e328dc8dd37aa7fbfe50427a6633f5f077c46a

    • SHA256

      8ab5753e0dd8b4a54a0cc842bb2b53c97ed33d90bcc445ce4de58d1df9dc9060

    • SHA512

      89588e15274d0bfb1d2d74adbc62be05a30faf1f040f3e4cbafe7913ad014661643b1bcdbfbe4f8811bad9f4f88fd6f41630d694db43b5bf6c54b576d4a9de76

    Score
    10/10
    sodinokibi$2a$10$ceyzqhh6apyg.fvmd5jbq.efimza/mzoem/ogbumflsf73mqre0m63597ransomwarepersistence

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks