General

  • Target

    8c716101e118ac65d7bdb900e0100d012256abb1d7cdf64830e5943a795ccce2

  • Size

    600KB

  • Sample

    210504-k798spgvbj

  • MD5

    f0db9243fdd14d4755f5b12860d0394d

  • SHA1

    ff1b6fc9398035917e232352fbfae8db7805b5ca

  • SHA256

    8c716101e118ac65d7bdb900e0100d012256abb1d7cdf64830e5943a795ccce2

  • SHA512

    824b21d96fa8ccdad18a8af1aa2dd234fb8c8487a6f81d9b98bdd4108c1ccfd28042b4c3f8bef9a74fadbc22853cc027ee4601f30928fd4ad611f2a38562e96e

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$lz3hlPV8Kej9uci3yqtcXekYgZKNgrmR77UkrVKzbLWKZi9Qz/inq

Campaign

5599

C2

bxdf.info

homecomingstudio.com

ledmes.ru

modelmaking.nl

corona-handles.com

botanicinnovations.com

cerebralforce.net

conexa4papers.trade

aco-media.nl

igfap.com

danielblum.info

colorofhorses.com

bridgeloanslenders.com

kao.at

kenhnoithatgo.com

qlog.de

spargel-kochen.de

kamahouse.net

naturalrapids.com

luckypatcher-apkz.com

Attributes
  • net

    true

  • pid

    $2a$10$lz3hlPV8Kej9uci3yqtcXekYgZKNgrmR77UkrVKzbLWKZi9Qz/inq

  • prc

    thebat

    msaccess

    onenote

    agntsvc

    ocssd

    sql

    oracle

    ocomm

    wordpad

    mydesktopservice

    infopath

    sqbcoreservice

    ocautoupds

    tbirdconfig

    isqlplussvc

    firefox

    winword

    excel

    powerpnt

    synctime

    dbeng50

    mydesktopqos

    thunderbird

    encsvc

    dbsnmp

    outlook

    mspub

    steam

    visio

    xfssvccon

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5599

  • svc

    mepocs

    veeam

    svc$

    sql

    sophos

    backup

    vss

    memtas

Extracted

Path

C:\vt8nz9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vt8nz9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3C7857C51FB7410A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3C7857C51FB7410A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: U7k2JXfRUdtQG3KsDv3Bib8eMCs9LgOtkBQYFbrFODnx7wIm2uj/DIGIQ4XUF6px HulQWf84U5smqh4i1MQem/+YbgFLQW/wZmZq4sGT9rvkYxkNHfQJv4KINQ2xoENF fUb1MhZ/Yp3x43w0au7iIvvlIkHp+6k1iSatDSUFvnPdVAz5Br2Oj9ekvyATfP/+ RG+xY4VS6u6Rs2OXn00xhJEc4xixfYJMlxjCGN8IYQ6gnMvSoUXUn5z47Awz5LbG c2AeiRG8r+HGWUzyHNZ3yQ+9Q9QxYXZhTs60N5xjVvdRL4ozwR8CwkfNR5ZhzsEb t923hvxxNVsU/4O0xlUqXxCiI273aHGtax0Comw4EFJUIXWlFHIjM9daj4KMXYqM KcuBqEkO+9FdDXhyLqMkAdaIAtxfdj54pLfsVF4PVAJpjRdjWF1vqjni4s6a/C9l Ff8HeyYKurA/eIjwwJeM1rGC4apCBPP1iQxYYrFquqevKz1fxURZiMtc2JKdDm6D PQn6BnUSJ+cTxIhGAZR0EPusnmCP13TP9zfFtwvlfYBS99mRZ6niQ2R9v5oe8COM HLdyzAf1Y6uktEFLpr2MS0xM/hjNs9KDyxtAVog/j1mp3/puCjxMGe/DtVu4H93Z ZISX4nimbFUkkYh4XZBl6MUULaiSu/sqKmCGxanNECboMeV6NhFs7lfPKzljOR5R kTZ1bhz+TKymtrMKbF33W86u6xJDlqZgz1Q0otG4RUL4znRFSFxUr+aurgQoiLdZ dsXb3+PoiQCMD6KStEUKxh51+vi8nMkPNZqvLS3lSwCZHPMRl/mSzIUNdtSHxAa7 h+trzRJKh2IhS003N8w65mt6GuokGRs0NgtfUpVt4iB0/Ork05zVukBueQaKEPC8 lSasVGmEitBSuiF0i7swSclTstPH7X7XyP2A8K9eufjiJIJ6UZdHvH8Lylg6sq1c qDBRy8T9C5q50U31i4CDksRzIyIeNCDXn/yqYTaI0PjDmpYt8fYjoDrXw3Ib8DDQ jEy13gUV65JJKnvNOZ4oywKt2q8M9pjbtJ3PUzVi+UsVnBA7LeFMPIQ52YjQrL/c SXknGdtGY655B2tOGCLaLtJeJZ/gPzM0Dg9rXV70z0xP+aw0/hNDiebpiUERnQCm WU3O4cuJl5pTLOY7WrwxhkmBLh7W6AkGWY9+Nj6CTpFa1tpLiFBRrVlYllVqd8Tx MflL6UjSSsTLW+fKZF4yKbK6XDA4QId38M5fwnO3LegDBHLOgQp566f/vD6yLcz6 nM4Jo8PlgNvjYWpntPNf9g== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3C7857C51FB7410A

http://decryptor.cc/3C7857C51FB7410A

Targets

    • Target

      8c716101e118ac65d7bdb900e0100d012256abb1d7cdf64830e5943a795ccce2

    • Size

      600KB

    • MD5

      f0db9243fdd14d4755f5b12860d0394d

    • SHA1

      ff1b6fc9398035917e232352fbfae8db7805b5ca

    • SHA256

      8c716101e118ac65d7bdb900e0100d012256abb1d7cdf64830e5943a795ccce2

    • SHA512

      824b21d96fa8ccdad18a8af1aa2dd234fb8c8487a6f81d9b98bdd4108c1ccfd28042b4c3f8bef9a74fadbc22853cc027ee4601f30928fd4ad611f2a38562e96e

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks