General

  • Target

    6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79.bin.sample

  • Size

    122KB

  • Sample

    210607-nr1lfa5yy2

  • MD5

    3bd469353983cd9ae85eae534a84a668

  • SHA1

    e0556ea1335207f0bf0a12a8b947d9c04ef69d52

  • SHA256

    6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79

  • SHA512

    0d5ebd7edead562fefeaad840ef1fe421adfe2e4dc2123637cad75226571f253c333c5991ce8935c144b3f0e89a7b60839a62cc9823ddea1491ee4c4d8fe2184

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$8aRJQYHF/q/ozXCWBIgKdON7BBfY6tIAItL7ubqWBK2RRFQEguteK

Campaign

7908

C2

ecoledansemulhouse.fr

psc.de

nurturingwisdom.com

transportesycementoshidalgo.es

idemblogs.com

mirkoreisser.de

pay4essays.net

commonground-stories.com

johnsonfamilyfarmblog.wordpress.com

brandl-blumen.de

birnam-wood.com

fannmedias.com

rieed.de

kaotikkustomz.com

offroadbeasts.com

bingonearme.org

norpol-yachting.com

carriagehousesalonvt.com

quizzingbee.com

mezhdu-delom.ru

Attributes
  • net

    true

  • pid

    $2a$12$8aRJQYHF/q/ozXCWBIgKdON7BBfY6tIAItL7ubqWBK2RRFQEguteK

  • prc

    synctime

    steam

    excel

    thunderbird

    dbsnmp

    dbeng50

    winword

    sqbcoreservice

    mydesktopqos

    infopath

    xfssvccon

    mspub

    isqlplussvc

    agntsvc

    msaccess

    ocautoupds

    firefox

    wordpad

    mydesktopservice

    onenote

    visio

    powerpnt

    thebat

    outlook

    ocssd

    encsvc

    ocomm

    oracle

    sql

    tbirdconfig

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7908

  • svc

    mepocs

    vss

    sophos

    memtas

    backup

    svc$

    veeam

    sql

Extracted

Path

C:\d62705-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d62705. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/508996C823A90E2C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/508996C823A90E2C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: uuvbg5HuKOYGfy7sujEsmeFHILyR6e0MzhsXIYwpL7RPlCO8llqdMc8FS+e2bMkd SY4tBN65E4Y6knJpL/FvKtZD5G2EfszcEo9jGKa0KCmeddEXctPJOBMPxY0yS7te s5dhms2YmUorjtNDP/ajm58sZKYipEegugo7rdJjhKbWNdvkRay+R5WJTCGR81HK 2Vv3u4ZeK1JYBI7PCc2zW6LZEGyfwTA9ey0dJJ7cJIgj0LtdO4GKa1TGcm6gHfeS u2nYmiQ2cFFuxNvgoup77mKaKuZD32YA6/3CAlchkevm7zomMF9ucOQBvCsrxIE5 33BdCvPSPR2aXp6ue+F/nsmYOGhj3sMxTc90QzCypBJyKG4m+YvFWQN+s4aSkoCr kBY8dcqIIIykGaxWvnfnPHjJNtIWzu3quiSmagIJLJ5YtTi92ClIxntUulP26iB6 Rzxg9qh+M06wjeImUUOPkRrMSb5YiwVNug7mQ/2UNzkVC5X9WLoqjQnBW3Mf9LGn xrazWAzPpaXx0qoEbP+DSCd0EbS6BRtULtrZjBK5XsSwn6MR7LWpKi7zNz64sCRJ cxPPbbnRF87+8mF4XatI+utAqM9HD3oTrzJjrBVtToJr0iAc6cxGJMMkW0aD0FKl 6TS3CkntmDGoUyGHCmEXiF6ttE1V+PMzD+W5Ft1F9nBDLyE9jjMeF7La6gxpNowe OXvoHs86F2gi1hjbvlFUW1o9VGFrihoCVc/D2zTCMonWXPoAj72dT67FNY76Lqf5 rS4RAdh8WcGfdz3psw8xzL4+KqPNP/u47tb5dqFh9U75LlZ/6Dx41zjJ7SXwuQgk wDGi4nz4LhJOZdBd9r8Z6suWNr8mpIaqRp+1YtNToWpo4wy7/MhxUHC0rOJVC0Ff r6x1D1+CggeHY1ZtYqfM4nHlnNuXOfgxlUkVYtHNXX5sJN7p4/1aPOdD2afWJjU6 REDKkxbcQFeDLh0YE+D8dwTiy4AX03xfrWFRRhtBe6/DtVw67g1Hr7/sxjx/Wpo5 W6pY1YpLz58qpB10Q7r7zvSlq2wxpjqLMOrviJpSexgCF47fjro1vTG10CXmSrd8 oP/1Qrw7Tfg4dR32XOhzC3sSMle0FsD2QcHZhrB7IcvoTdyH3RdaltwdjHOwiuXP 18qX1egIG0diNBPB8zU15jAp4X7oMhnnfhNAaDK2is7DjiKE7EwMiYMJsP9ssWXP MXFzzRzvRXGouO+J3bpC+URV8VtGp7gSebSKBRZCMmXEAJYnObFrAjAJS1XFUobg iWJ8mvQb ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/508996C823A90E2C

http://decoder.re/508996C823A90E2C

Targets

    • Target

      6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79.bin.sample

    • Size

      122KB

    • MD5

      3bd469353983cd9ae85eae534a84a668

    • SHA1

      e0556ea1335207f0bf0a12a8b947d9c04ef69d52

    • SHA256

      6de45c62ce1024829017e4e46177ee4df4b79f296c519bba0755963aecc92f79

    • SHA512

      0d5ebd7edead562fefeaad840ef1fe421adfe2e4dc2123637cad75226571f253c333c5991ce8935c144b3f0e89a7b60839a62cc9823ddea1491ee4c4d8fe2184

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks