General

  • Target

    5237aa6179a201f22ffaa6b114de37f020dd1b0d0940280e40f75d5e4debb0f8.bin.sample

  • Size

    435KB

  • Sample

    210604-flzzqrbdxs

  • MD5

    f490c7980e76c512f4ccd0af9400ffc8

  • SHA1

    aa5638aaba37742c3d433f856ddae25b3882a624

  • SHA256

    5237aa6179a201f22ffaa6b114de37f020dd1b0d0940280e40f75d5e4debb0f8

  • SHA512

    9d61648531d864058c5ead459d300e68cc3b5922aaec264e4db5da5e94ee8edcb19263769c99f82949fb66943abca5fa80888810069373255d19ae07477650cb

Malware Config

Extracted

Path

C:\82ts2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 82ts2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E1654346F373039F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E1654346F373039F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IsHAYuWWEbXXa+r0yY1QpGd6AEYDCaxvlyFG/E4b/IFnRm11i2KgsxwiNMSv3zEg +HQixQhNQJDW1dLTX8+EMgXXZBn+/7t77JeOyo7AFh+Ot8RgupspRRhEE9z4TxGz 54HCa/zb2Pa4/VtwFZqscEzVvVUyyLQXHvMbgh/+dtwQ+bf7skGxWcl4qCj0PJoH vKs+XDboEgvb7qCmGAg4+hsU9Zd63fVotIstZYRLvpfDg4DyekFQ3SsArmExfpTJ ETU/FDRQkfwRSHm+TTSRTJ3G4kBr1ggeCITwHnIlkU/GxE7kTT7RrLimxELooiyf 7bpeTDjDTq6YI7nVY3IfPVRXsAjnixppkjmoJP2ftyl5Zfq2lXSa60fE0HxQcVPm rX0lXCScifyoj+6ckvOjK11ovRBwa6UkdRduLduQHhvyOeWZEGXMNw8oeFW3RkuU X1ErOhEjHQsDXSDh6qXGxP87+pGCfiwZCrrNfSaGmTK1/P/atcxSkot8dyDEnK5h 23w+c/upaK7NobxerqgWtLDET+2bBwMDyGs26SrH7myNSpVmJ0UyyiZNxCCG4jkR vh7T0cveY7KchUQGnCBg5ozMqz1V1aLpxvp33JIUGjzfOXiZlYPxhyvg9sXZZe2I 75es0eQnJJ1iglL0okX4NT8pRjlMkX+k+5nBbslrBut254RWnv2lADzt11ZaUimc ReVfN9rCEtdVppKPhqLRC8jwf8d89PpCqmT22gtirful10gv1KQkz1j/v8ADesRO mtN2HCPFdjugAcpERa1cRuwCx+4G4QYWeK4Sj+2dvdpPGyefF5YenV3a/S9fug72 0BOLjl+Cyows20UqXPI1Qcm7k7VaJEIdqhmG3YAGOoHF5mtaztahuCXxaawnnUpJ z2kCVQGmNiYB7UwrWeO3GkpISXQ5sh/CuSKwQNqR07/gGR8oQ2gdXAQqWRvJlZfB GakXB/36HJj9TAkFxnNXQUZjbQ+t1ZYicAmERdz4w/NvuPURtzjRSRK35rT5qgnY jITNURqPooEBhVe2FFN77RtBRm/NK8en59rDEUd/EURFaTg5pF18j1t8QZtOkUCD wiLQcpvcWxv0v5YqOXYuHIh2ixC4Ug88CCtiREEa7i299G0bN6CseA0v1mVU+U88 EYlwCGWmhPM0EOkF5pXsG6JLKJVtlr7InNIyNoJCRQ7mtJabxuvMBP1yHRRAuuuo dmI5c2xG8XKGOtZ3+7h45DK7beM18N1TlrF7rXrZYYoVDx4O6N7psnQ0nUNIaTsw RoG/topEsDFXJ7AYATo= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E1654346F373039F

http://decoder.re/E1654346F373039F

Targets

    • Target

      5237aa6179a201f22ffaa6b114de37f020dd1b0d0940280e40f75d5e4debb0f8.bin.sample

    • Size

      435KB

    • MD5

      f490c7980e76c512f4ccd0af9400ffc8

    • SHA1

      aa5638aaba37742c3d433f856ddae25b3882a624

    • SHA256

      5237aa6179a201f22ffaa6b114de37f020dd1b0d0940280e40f75d5e4debb0f8

    • SHA512

      9d61648531d864058c5ead459d300e68cc3b5922aaec264e4db5da5e94ee8edcb19263769c99f82949fb66943abca5fa80888810069373255d19ae07477650cb

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks