Overview

overview

10

Static

static

37b8da186e...c6.exe

windows7_x64

10

37b8da186e...c6.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6

  • Size

    308KB

  • Sample

    210504-ctzsd7vp82

  • MD5

    ec423a03baa81be57f07cc2243552d93

  • SHA1

    7089c6d938e3bae0febac05f4b4b10bb2f92142c

  • SHA256

    37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6

  • SHA512

    6d533efdd332e362e9cf41c17db6dc07f41fbeb428a1a303c53d3b6b71277a2df3bedc6d2c347279d29ff34cdfc1998201f3b709adcc5ca6d5e8811d11272191

Score
10/10
sodinokibi$2a$10$t3dhtruanqkuwj0zthetbo76elgnsuz6qhedd9elbwxl1fjinkeuq3612persistenceransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$t3DhTruaNQkuwj0ZThetBO76elGNsuZ6qHEDd9eLbWXl1fJiNkEUq

Campaign

3612

C2

all-turtles.com

smogathon.com

mediaacademy-iraq.org

nhadatcanho247.com

milsing.hr

cursoporcelanatoliquido.online

broseller.com

ftlc.es

compliancesolutionsstrategies.com

ampisolabergeggi.it

cheminpsy.fr

planchaavapor.net

vibethink.net

rosavalamedahr.com

lionware.de

liliesandbeauties.org

smart-light.co.uk

gadgetedges.com

psa-sec.de

ledmes.ru
Attributes
  • net

    true

  • pid

    $2a$10$t3DhTruaNQkuwj0ZThetBO76elGNsuZ6qHEDd9eLbWXl1fJiNkEUq

  • prc

    infopath

    sql

    mydesktopqos

    excel

    powerpnt

    xfssvccon

    msaccess

    encsvc

    wordpad

    firefox

    ocssd

    dbsnmp

    steam

    ocautoupds

    synctime

    dbeng50

    winword

    agntsvc

    oracle

    tbirdconfig

    thebat

    mspub

    ocomm

    sqbcoreservice

    outlook

    mydesktopservice

    onenote

    visio

    isqlplussvc

    thunderbird

  • ransom_oneliner

    ...ALL YOUR FILES ARE BLOCKED AND CAN BE LOST SOON... Urgently find: {EXT}-README.txt in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!

  • ransom_template

    Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "{EXT}". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}

  • sub

    3612

  • svc

    sql

    sophos

    mepocs

    memtas

    backup

    vss

    veeam

    svc$

Extracted

Path

C:\456ubtz-README.txt

Ransom Note
Sorry, but your files are locked due to a critical error in your system. The extension of your files is now "456ubtz". If you yourself want to decrypt the files - you will lose them FOREVER. You have to pay get your file decoder. DO NOT TAKE TIME, you have SEVERAL DAYS to pay, otherwise the cost of the decoder will double. How to do it is written below. If you cannot do it yourself, then search the Internet for file recovery services in your country or city. Go to the page through the browser: http://decryptor.cc/110E8423B6333937 If your site does not open, then download the TOR browser (https://torproject.org/). If you can’t access the download page of the TOR browser, then download the VPN! After you install the TOR browser on your computer go to the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/110E8423B6333937 After going to the site, enter the following code: ctins1YRR1rpAzyFxjb0tHWlw8U/EsCI3iQ0eHT1NKyvRhjUZ5UnEq0IyRPimn79 /z0/G5jL5wta/UnvHjwFjqcEqJZH9AJm7ROOc3SoCAfRC8bfboBroLzaYP7ulFDe ErOdf6EPN7aqpQmnWOmuebb6RjiYW5FqrSJQuqUOeHO00hM+rYeRFp51g9QWwqNN LtM35Usd2yZd3NULnA0p9w3iqzE4PvW7dmav5FE+TZcX456oF5TIhYYhCVeBawkA 5od8Afalogx6WD5ENehffKE568gRhWJyUoemoE+FBnyO6MxlFBy8EhSQTPfRH3K1 TUeb9hwQ8nRmrBB/PivaHdQywyHiP8endH4KJE82jGHhD0TepDaP+fMOryrJZjgU pM28i0WeHaI/veuS1IU41tDXIlhgniwKLooYOPX1Nq36gHmVqsGWd0LC68tvtI2O G+HDsfItqLKXeL671sZIp3/p9zAqo7054D0o8+q67P6YfLr+ylRtKhrbgIeaQptQ CjWs/FCprg+cM0rH2wEnYNPNyT0kfJ2GEJMnNxampICKex3Hph+o+Iv3zcP0OwkW gssoonj4bZWtYyuqx5jbGd3/39+DP4D7rgtqYDN47FE6oteUykI4W3J+tfXI46lq jBmbT/frj9V6FauQQ/z4LVHH8fwacIg2b8+dnYzwcAcA3WQd06RiwMoiYMTXBXL2 v+eS2DdemXv27bfQ/lz66AxPhwNJHEsm8xT9gjzM1fCfacXkYUSptAFR/Kyi+/Af p5SDPuwKTQC/bKZ9o11XqWTudMCD/bNLxKjgG+73I1Vy6PxynzXO1/2YsZFAA4wf tUbkHrY9kTGmxX3/x1DNzkInQCgx/dhGKBenOTqFFjXcq5pHLnF0er9nctwZFPQM 7qR0jtds8SAH8XztBWiHWlpaZzoTAj7fZUst2jLBkI+5XH9g662iwWfyjDRKEXFA lVoFhAdL6Y3jQwX4EV9lbU/jABt2oIovdLzLV8CGXvEFt2QnZMpVqzf/lo4+6SxT cWIonVltOt3BoxDhmekIMMhKv5YzJLLZOrVMCIXV0gYLa9tm5y6RKmbExAV3K+Jy IJCGK/Jw2B5/Dn3dsyUEwTTjS3qgQMyNXFr/LHVF+pFaReoISAhiq8S0CsC01Gx2 c0nd3eqJTn/QWkTKe4QsEn+z79lGhBsBspl1LZ2J7lojesrXvNWN9YzGiz6aOO30 uM1IykjmUU/ymC2KxqS8FLNuy4uHykQuVVdZ/OvEnT7q8BewqOGiFEmtFRLJRwVD opVjiJk1HF3rm2ADRr7Ujogs
URLs

http://decryptor.cc/110E8423B6333937

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/110E8423B6333937

Targets

    • Target

      37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6

    • Size

      308KB

    • MD5

      ec423a03baa81be57f07cc2243552d93

    • SHA1

      7089c6d938e3bae0febac05f4b4b10bb2f92142c

    • SHA256

      37b8da186e1d26247f942dab67b5d6d24e0acb0d7fc3c583d4cad99fb36c2bc6

    • SHA512

      6d533efdd332e362e9cf41c17db6dc07f41fbeb428a1a303c53d3b6b71277a2df3bedc6d2c347279d29ff34cdfc1998201f3b709adcc5ca6d5e8811d11272191

    Score
    10/10
    sodinokibi$2a$10$t3dhtruanqkuwj0zthetbo76elgnsuz6qhedd9elbwxl1fjinkeuq3612ransomwarepersistence

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks