General

  • Target

    040818b1_by_Libranalysis

  • Size

    813KB

  • Sample

    210505-tpeaq28cks

  • MD5

    040818b1b3c9b1bf8245f5bcb4eebbbc

  • SHA1

    c0f569fc22cb5dd8e02e44f85168b4b72a6669c3

  • SHA256

    0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402

  • SHA512

    bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1

Malware Config

Extracted

Path

C:\11ou37c-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 11ou37c. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CC63D271CF22A3AE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/CC63D271CF22A3AE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ATU5okJw7pHxgMwHmujiZbBAu/XqRQT9CrwGBXTal1yBXVxGYAn7Yr2LKEdtnQYf mf9v3vabY0KrugoySlp3+rv+GaasNfV3AkCr/zxt3ExA+Sunwdpp2bIuBosmK/Ph ac/f1spktqv9TTQD52TUjN9iurgRB2aZoOZflXt8DqclsHaR1GyIMMCQ2LVKFc2D OtucJ5xXMkyhKVnb36gC89qD+kIjEUpewUGYLOjHKJL/6qAvkOQP0xiQe6bsqsFt QW/D3ZwVgEZC+PLQDQ5QWJGIxNNVGGzvJV1V4xP1JQVnKHRPn+ZucWG1HPEcEJy3 8d6r5yh8Z2ISaUUYSDCIMigecL/gBPmEU98C27o/H/KNCDCEpKjf/fAbzmH7tGcJ OnwyWm3PfymucR2+HjuZzsg9+e6fskCUhOjI4Okk/W/GnXusumi9rPysPKzloLvj GplsxS19XPortkQjBeoSRlEpSONHjuYIiGTRSxxYLeQ4Zw/71W948H0Bu86IHxX7 VdX6lXXIiiOEM1VV9zCWXYZ+GilM3z8HtMfIrP/yBC/b2QT0Ox6NJLYernpEkzoO 8Z2tLFDjOlaItMW/spLjlt5NvMX6JoA4DgHStCEl3dqk1YhGl3bQNZlQsD3PZli0 wm8noQicBeJ6vZ2vBQrgcp1AZF08m1hDkEzHg5Q6Gx6LRx0mn2C93cmCnQZYzGVG Gw09VX8U2tzTTrCH1p2pyDMCxugfERoIvd95VGJt6WdE9M7Q1hHwRFN9dT9+fKk7 Let+uKxUd8sqMyPy55SBhQGF/BZknJOeNEtE5HJnFwZ8mZyApLDN+ryClta7yxdm 3WbJa3b3q8kI8x/v041Y26yBxqBt6FK6QF464dWWzJfJuL0T1HXAQZerERZLeBv3 h4TtdgDaOR4VslhlgtrGjuiOTkz6N5kE9qCX5V2j8Uv/0E+6vhiuxHnQOtZh52HU SQ10kKbr9nahA9nYpuZ8oshAGJrvlctHtsI1wzzjEdwwN+PIEm4GfMaxl+0+fvml Rc/Bztj/oQeeHpC3jZg9qivsSZUHilcrljl4BGVvg8eSmFSs40GKuKq9jxIrvJU4 6hMRkIFNB8Q3NuzSVjBQP8CUjizqpVIjH7Uli0BO0NrNBwzWoaErGm2gL6HN2pSO 3xkdQZXaDZ983PbfcqH4Qd8WCS/0Wwy2MzxPV3Q3wdS8mgUFh7mX3IIQiI3RluUW +h2Ci+GMv38LQst7HvM8qt6ax8io4pOr4EJCmK7dnt8IWcs2pbjBGuzKCH4CUA/m vOd3tmNhSms= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CC63D271CF22A3AE

http://decoder.re/CC63D271CF22A3AE

Targets

    • Target

      040818b1_by_Libranalysis

    • Size

      813KB

    • MD5

      040818b1b3c9b1bf8245f5bcb4eebbbc

    • SHA1

      c0f569fc22cb5dd8e02e44f85168b4b72a6669c3

    • SHA256

      0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402

    • SHA512

      bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blocklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks