General

  • Target

    a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6.bin.sample

  • Size

    121KB

  • Sample

    210601-9cmejnn4va

  • MD5

    b169ce72bc3f9f0838713d53ab08e9da

  • SHA1

    268fd636b359f9ff425ebc7a591fafda6d7f93a8

  • SHA256

    a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6

  • SHA512

    12830464d6744130e69185d55a57187b7c1b3b42ca701069f5e2c3a27d90009f8ff4972d323243cf78009cc8ad0d6d3995577a0fbbb0fc05bb3cf80ee8cd7567

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$VWYnEw3Qn4WvKsI2xMi3nertu3hCKHafOqYvXT53oiyGnRXJ52gmW

Campaign

7737

C2

vihannesporssi.fi

dr-seleznev.com

themadbotter.com

werkkring.nl

abogadoengijon.es

naturavetal.hr

walter-lemm.de

sevenadvertising.com

thedad.com

cnoia.org

4youbeautysalon.com

jobcenterkenya.com

synlab.lt

irishmachineryauctions.com

siliconbeach-realestate.com

smogathon.com

datacenters-in-europe.com

bockamp.com

calxplus.eu

starsarecircular.org

Attributes
  • net

    true

  • pid

    $2a$12$VWYnEw3Qn4WvKsI2xMi3nertu3hCKHafOqYvXT53oiyGnRXJ52gmW

  • prc

    oracle

    dbeng50

    sql

    onenote

    excel

    agntsvc

    sqbcoreservice

    thunderbird

    powerpnt

    infopath

    thebat

    ocssd

    xfssvccon

    isqlplussvc

    ocautoupds

    ocomm

    mspub

    encsvc

    winword

    tbirdconfig

    dbsnmp

    msaccess

    visio

    mydesktopqos

    firefox

    steam

    outlook

    wordpad

    mydesktopservice

    synctime

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We download your data! trailappliances.com - More then 320 GB of sensitive data. Included: Accounting HR General Payroll CONTRACT INFO Drivers License Abstract Financial Statements [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7737

  • svc

    memtas

    mepocs

    vss

    backup

    svc$

    veeam

    sql

    sophos

Extracted

Path

C:\98600-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 98600. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). We download your data! trailappliances.com - More then 320 GB of sensitive data. Included: Accounting HR General Payroll CONTRACT INFO Drivers License Abstract Financial Statements [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/110E8423B6333937 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/110E8423B6333937 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: b9fSw8PYlTot+eppll9u15dbS8VJBVb7DxrZFuTsWokUJtKIun9HB+g+ydg5OpD0 l+19P42706dZw0lVpDprGPcJM04n6dSEGqzsYixWjfGUvHHbibhkDDW3G/QSrtZ2 MIvru7OI9VkWCHCtO0RgcTRBXCecEaveB2HBin9w0P3NBYldVj00uzbSXx6rM5D4 NM60bEmKcBG4qdrGkoNGEK5RuqmcVTLvrupqFi3//oH5d9g3wb3wFRGWzUK8qk4i UdD0KM23iFLk08vsOeCoCgXPHTqMvp8dBN4Idhzev9HIY+h2MFRg+bM82dfSw4xX futDB+uIoybS2FrgMsE2Te63hn1G2ApmqgI4LNDyadYo4zXjGTskDYBzaY912t9c wBeh8HXehwGePtJ3ER9Uomi5DlXwof+IjbHjTvHWWSNfzpd1bPYkDWzM4RaLm9fX 2+23VGkrZK74NJ1niWaZ7fpDHIZhzZFhUS0QCqy/secELOjqzBePAXjsAqK8H4rI JirKmAYp5LAUsoCdyrzyZ0gJKKFOQeE6ZbnTPEcMJF66hfu357ssUmxU8e92nVGp nWiTQnaLLx2cs7Exf4qDrG/G1mSuG2QBipK9tCI0foCbYxEdpu+aezs9y8DGHWML PWUOn+84n3DSN7qH0L4CPNmcVwaPemiBa6vr1zkDPpfjolar4XyHAVlPq9oHIYsB QzmstmzuP5guRo7r4dDNMYZxMfYk2u4KsqNpBZGWUXXYN2i5nMaSXrcvWHK3cTXZ 5kIoF5PyxHaRMiwI9fkb65q8oHwmXQ2QYrgqiv0qZMqJ6egRQeHkXdWepIRUp0V8 u4xTNqVXrgd515a3MTLCRD0MQhfeT0ADuCcIt2vrziNX/WvJGdvpMoWmeqgW08Gr E9CDHBGR1Xndvpl2Hqp69s9G5bM5/NAG6qHEI9qAkuRg3GImHGa6vuByUo1ciG0z bLdORlOj6IxFzZHARZRZTRyAspmZXFUtTIvRLSS4ddCh1evvUpoAEw8iki7tKVbK HypU2dB/T6X6FTpj9b8iEmvxmCKXcqxQm1tWsB88vuuyXFchbCMIMT1FPdkFA+Ec 9K8fgbSVgnIUYleSd6du0h8owr1lrsuvdy5GlBjUfa7+ebRm7doOBOzWJ/yqCIWc QAlOvyD63vm2E3virh8LIuTvlQWBZr+3ty+egZo1chNn1E5gmM7cr3/lDujGF+rI DQuWXyPH8v2EmBH6ZwmalKLWvPxjE7djMULOCNbiGAkrEQeQFTGU+1fSZi2+mKUg BXs2Zw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/110E8423B6333937

http://decoder.re/110E8423B6333937

Targets

    • Target

      a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6.bin.sample

    • Size

      121KB

    • MD5

      b169ce72bc3f9f0838713d53ab08e9da

    • SHA1

      268fd636b359f9ff425ebc7a591fafda6d7f93a8

    • SHA256

      a494525da7014eb1fd267a1a47cd4ed6c5e3b290042eb34c8b49f0346a45e6e6

    • SHA512

      12830464d6744130e69185d55a57187b7c1b3b42ca701069f5e2c3a27d90009f8ff4972d323243cf78009cc8ad0d6d3995577a0fbbb0fc05bb3cf80ee8cd7567

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks