General

  • Target

    44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93

  • Size

    122KB

  • Sample

    210617-ttczfqhcss

  • MD5

    84645b3639932f0ca17d8e13c17dff87

  • SHA1

    4435d46fa99b53cc986f16e41dd68823a77161ab

  • SHA256

    44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93

  • SHA512

    5e4039974929fefaa43dc5d2e396bbaf1f4d88c8cfaa477b7705295cd310676f46d5ed17f1a6451e2040b93513654ab6303fcce2cceca1f7b4ee4340e2ce5eb3

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$AJHD/OA.DRawIcpMsNUxDuDFzZ2jtvKVsPCK8SSbjYZSijT9kiAVi

Campaign

7820

C2

zonamovie21.net

milltimber.aberdeen.sch.uk

theletter.company

dr-seleznev.com

caribbeansunpoker.com

hokagestore.com

theclubms.com

kamahouse.net

sarbatkhalsafoundation.org

harveybp.com

blacksirius.de

ecpmedia.vn

lapinlviasennus.fi

spinheal.ru

no-plans.com

smokeysstoves.com

centuryrs.com

adoptioperheet.fi

physiofischer.de

mirjamholleman.nl

Attributes
  • net

    true

  • pid

    $2a$12$AJHD/OA.DRawIcpMsNUxDuDFzZ2jtvKVsPCK8SSbjYZSijT9kiAVi

  • prc

    oracle

    msaccess

    synctime

    mspub

    excel

    xfssvccon

    ocssd

    thunderbird

    mydesktopqos

    powerpnt

    steam

    thebat

    isqlplussvc

    dbeng50

    mydesktopservice

    ocautoupds

    onenote

    outlook

    visio

    infopath

    wordpad

    sql

    firefox

    dbsnmp

    ocomm

    winword

    tbirdconfig

    encsvc

    agntsvc

    sqbcoreservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7820

  • svc

    backup

    sophos

    sql

    memtas

    mepocs

    veeam

    vss

    svc$

Extracted

Path

C:\j97i62j6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension j97i62j6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3DF9470FB8F43741 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/3DF9470FB8F43741 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zbFHwocJV7ULznt2wddKK3d3WNQ6+YEjOExoAc6PvNwl2Zkh9hT2RGglIIZEduU7 lHknZ5YTVwejAMPAyisu5Ln8SrZSguQLj3mIoSO7DbSbvxY9uvaih9v06qZMV02v bxNqt+Rr+iZ57+Srb3PXQfs1Ncd/7GTMYa0+XQDd7HmULqJLzAdvc9OiJ86+p8U8 3+Atsn9Wh1ZUElYrZAfdQfMXUbtimM/zV8jo5TETbKAIbmyAvIA82W54y3y/9uCy cON6cXbLfCXQD5iUixl2Ztqxg7eGxV/sv7iie5CtzlykS+iLlyvYzxGcmUexDiQr sAzAFUMwgGUWlmKj0LtdbiWn25Yy7BDrLxI5iy1Kr7EZk5QB1OniUCzjUqXtmCZa IiG6WmbXNVd1vz34m+4/RMeWhBDxIOcQzpMOEH7jqW7QQVoQcDotCP6PKPJhNhza zVEk3h+X/2i29q3XO4euokz7kwbJ0b34etbESET95+l+qS6GiVvtbwPxjHOvHTOp 5j1NS7RczSHiBB1ehWy0byjaLH38cObS0bDUlTFYVKAn9dtm+FzQdcfesAogDcoM mXsB38Zw8e3NdGONIiJ9t+O8lX0qeCqn217s/4k3eX4eyxtO2uFP9eS8Yx6aMBeb Jv69iQIjKN5NbNRYJO9zK4nEANRJM4zgAIz81b9p/ozGq0Cl/3D3sCGwEG32mZ6x oG2CEfjrrUwYIkjusUtcC3WewKX0dzd3L3SGUZnHbqo7C6lr6yNAp8vI/4d+c/g8 9mnk64x9/R3RG79pHxXNkisqO/ukA+FsNAW3NFyFlPApdqrdxvF5GCr9iY4E/ZsA D2PBSlpUwxOm1Mp2zk7H+s+nNHagFagimIRQ5w/cAOofF8208AN5PzznXD/8aqll uitiuZbDjU2nTK2+kdbKjRVpUgDVO4KAHEb13p242CaE8NmTRvkzT4LBtSKbC0yW zHLoYguYPBP9yTeHWY19D7Pq9VoBzvKM+TMK1kKMPyM42Cg8vHfP7DUwvxUkJ1Qv EyQ0FCXGkhDx0mYdwvhNghAKUgftFS3MGIiK6+CFTuXtfR1HzTNomHBQ5nBNC1EX DAZPanTudFXbqKomexd/F/m2D1Xn0QgitTkvf5nphV+Ex2H6vo6kahqVDoTZhnE4 c8MGX9HtxUjhQFN21ALLWMwqn4DQpeyMk2KeASTlTCWakVnGLze5J3VtSrSfB+zP BtdLFemFJJ/vr+MI2a94u4+xiE41xWmhmCeL7INKjdEU5aUidF7/kBfjIk4wp411 4JW2tuso3WTpRjhMppjHOg8EsZj08m5EWt8= ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3DF9470FB8F43741

http://decoder.re/3DF9470FB8F43741

Extracted

Path

C:\92y6uyse-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 92y6uyse. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/64F9D9A943E5E574 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/64F9D9A943E5E574 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TTFXCIng95fRGknLh0GSyDHfTVQtQ2b09P9SRdfuApZ/26QgwTuvCJ188jCh4JrC our6ptLzxczkY77Ziul73jf3PHbOcuGrZF2rMIPR259kW3WKv9OceJUC6zlLwBYI AYyiW8Md8uQojFDeloChi8Y0tuw/O1VkNfUikhE55hrKVyYcR2bwLCWiz+wyvNQ3 /TigwlDyDh3hbAnKguVecQ8ylYdQZTTtKnbLTWZZvPpT9xRGLaeagZ2KWX4AbMe7 aaxxNyv8L0WBQ9igpqLEgQ1rulp/u286rWGCXus4hgKQUnI4jJlADMKE5bZVIHjD gL7BQeU6IEThxqkSpUlIwFHBBGiGOQ0z3LwEJ9sFcyOqOftfIjciqASH/ycfNMJ1 u1JKSDjFBB+nl7y3LceSd8y2z9NpUC1VLZzpD7+hydKJZ0ovYxMacrNE8rxMOl1z HkC2LojeUW7mLwuNWBiHDMCe3/58aILRpE+y3lYytwkSEJRMLfdfU5mx9ijnv9+C oMBE7X19HLHHFO49b8EvUvA2veKdxuFeFnLwpdTnPJusT1lfxCD1ft9655RojTxH RgA4h38znQy5UgMYkBgUW8E27PD9bIBXoTfKLrOecB0BF2t3TzPMKcU9pskH6Fcu nYe2tAZQsJXT25uXkvJXtXrTImgecEvF/QdDJaGjkTRjga3jgNDZTL2tHwW5S2lj BBPV1BkaHOO3o/akk9gS2P9qXGFzYc8RR+hq54KJM/i6bwovQlEwACFrMnVHRpEb DfDiRYvpg2mnsUpPdRQpQwWRYbyJCW9aQUiiNoWsn1qD+Re/gMTadJW4+LIAL/1B q56mT5qpK0oQOMDVAqIxrjOOCUToI7R8EiqyP4MmHh399p2Zq9sgd3M5rosu+mEG 14P8GUxF6kpHo8LKa1x5TP1pgYJNWAmt/O7mtKV99F4WruoYboV+Z4bLzlWB9xz5 1ryc17wjDV8b9QXILgVyqeiQKmuiOk8tspf7L+F6wb07nwjWbRH8UGPkPhV9MJT7 YhBRZIHymqIaJC86Yzs+Z0PFuKoQh+Xiwi3Uu0iPk4ZyKgxOETI9kYhMMZNF2TuY 4nMJPL2OTwajSLCW61uTJb1FhQo8n9YScFCmE2vFLD+ZBEYuDnWxbsr7ZsvsfYw7 HY/q4hD4QcJgJZIWbSt/OKTzJqwqm7elCJ4r6VV6T7JnLpzc4JkakAc4ir2VHzR9 oYLS9+l04gP5M7q6bdkWaYRrwS7/XiLcHeCVmcJVzouDzo7j+jsqdqzlXe5Lj0hf eaC8v4sssM8BeQ== ----------------------------------------------------------------------------------------- We will use the data gathered from your systems in future campaigns in 14 days !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/64F9D9A943E5E574

http://decoder.re/64F9D9A943E5E574

Targets

    • Target

      44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93

    • Size

      122KB

    • MD5

      84645b3639932f0ca17d8e13c17dff87

    • SHA1

      4435d46fa99b53cc986f16e41dd68823a77161ab

    • SHA256

      44cd22cb40115a504bf933ec006d47ae0076f450f76b54783f846beca81c4c93

    • SHA512

      5e4039974929fefaa43dc5d2e396bbaf1f4d88c8cfaa477b7705295cd310676f46d5ed17f1a6451e2040b93513654ab6303fcce2cceca1f7b4ee4340e2ce5eb3

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks