General

  • Target

    0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402.bin.sample

  • Size

    813KB

  • Sample

    210602-gn6qar4442

  • MD5

    040818b1b3c9b1bf8245f5bcb4eebbbc

  • SHA1

    c0f569fc22cb5dd8e02e44f85168b4b72a6669c3

  • SHA256

    0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402

  • SHA512

    bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1

Malware Config

Extracted

Path

C:\4d7w2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4d7w2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4643B287026A9E45 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/4643B287026A9E45 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5z+52VpgffrKq/aLCramO4qnTcahcxHaXtSr1r5Ty+yb9HzMjNYyoa/X3xvyNgUN yhRGlxaeKTiXJgL5yNP94fsexQdEFnsNxrjAWRoWCUQ9UZz73NsbIsyaknTfwmae X5HoitWr84FTQ4qm93oOlVdV3zZbygC8gHVSYtCaRHQ9kXb8X29c0LgwDl7hsgM4 agsZ73UyByYPaTYvMKeNM6QIXDEhRqnkTEm1Ctd3ROUJ4k8Pw6IyDNndjro4vgfJ GZXcovCVqPkDu6IdayybGWrOJHAUe0Ze2zH0q5afdizpMQ3u1iWqovWlXdbnBdkc jfK0tcZ//umcjhBGttvFCVNLE1FxiMsQf3EnyJjY/4yC+RF2zCpAtiaSjidyg4Je sfvNMoP60ObJKaEtxVK9WhEkC2ojokEFP54MvG35mepP7TK1G0OsUTREwxmzfGpl 3Gs/7NyIoBt+lAQu4nTVeQEq/EdiytrW2AFbb3kmRnuFY9yIg9QyMH4yZ03sEBP3 iUFa6WiNsSM/52+/8lxrlxeZc6U/Nz+ypWoUbi3UZTef5T45lvTSSRmY1L+fl7Ho wHHoGCCKVZwTx76weUOe+EdpKsRLnCyK1bCdNGWMCFo8t2F+1R6hm5hJiiUWBmoe PWQKa1+vrb/fSC71Hez0ksmOL0UdZd6UzoavJkQvR4+4u+DjKrgpnp00JQnbQhIW z7k/bU/ExlmSTazuybiC2UbxT7wIldsWzdH+Ed7UzjGR4QXBsw47ghc3K1taZPFk Blc01mmKHzFC8N/hqtBKCyY/w+3M72kyPiNVC77+sVSTS9i64z+xzt3wmKsEvC+G a/KvqWdhPsurCTxdMHvIUXFmfK4Oh7kdK51RrfeVit0+nz5Q9gkMN2oneErxi4p/ rVKhD0ADHhnkuz56unpQV3G2kYv8uFI2pg4WKZSVoUQs8N0I1X1ngsxGodm42SFH cwI8Z0rFgrL0Jzw3Uddn4lGqpamjn10TPBBklq+71D2hi6T2hwY/FPZ60BR+nw03 usXPJJ49lxpHc46UUmaNRVNDlbxjHRsvFooytOyQrU8SvqaoVhIgAyA4zpn2yk2Q DF0Sy4Uy5JtTX+S9H28rhy5Xywphl+kXQ0SnFS9lZ0CHBi0GpXlf5curSevugASF O128OH1HhowQA1UQqoyUW3tM9Bhta1KYpf9qHcvfOI3sHnDEwk5iH1d4eTKSetHC BoACHpMVW+BCET6zGTp1HG5/DJLxdNzlqVZWvDS2gWjCEI7j2I8WgiCnQAfHEuCS oeSt2Q== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4643B287026A9E45

http://decoder.re/4643B287026A9E45

Targets

    • Target

      0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402.bin.sample

    • Size

      813KB

    • MD5

      040818b1b3c9b1bf8245f5bcb4eebbbc

    • SHA1

      c0f569fc22cb5dd8e02e44f85168b4b72a6669c3

    • SHA256

      0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402

    • SHA512

      bf4dcfb3c7cac05776560e751414a8babfa25fb8703768d0264133d4964f841055cfcab9f30d9854e422642855b4452b9fbf431889cb70a37ecbca7564f638c1

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blocklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks