Resubmissions

23-08-2021 11:13

210823-gdvketlplx 10

29-06-2021 08:46

210629-d63daj1whj 10

General

  • Target

    c55646354dd7d92f9b3252c8b817baf22157610d9491dc7d0f299dad64d8eacd.bin.sample

  • Size

    122KB

  • Sample

    210629-d63daj1whj

  • MD5

    8a7deb28bf1fc0925142ef2f9bac9883

  • SHA1

    6e9d34c13f303ba3f4e5edec702383e3b293432a

  • SHA256

    c55646354dd7d92f9b3252c8b817baf22157610d9491dc7d0f299dad64d8eacd

  • SHA512

    3f9298131593033c439d99107290461370c675925213f39ba9ffffc626b9cad6e6e4f6efcd4c1d4761eddb7796fa6e36e1a519617176d53d10e551452ef00dea

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$vaot8ALFLXuZNXaaLZnSlOKtytQs9XK6ZZe5twEouKcmYA96uqWt2

Campaign

6861

C2

shiftinspiration.com

gasolspecialisten.se

gratispresent.se

epwritescom.wordpress.com

drnice.de

bricotienda.com

associacioesportivapolitg.cat

nosuchthingasgovernment.com

team-montage.dk

body-armour.online

profectis.de

drfoyle.com

faronics.com

myhostcloud.com

parkcf.nl

colorofhorses.com

lykkeliv.net

smithmediastrategies.com

bookspeopleplaces.com

psc.de

Attributes
  • net

    true

  • pid

    $2a$12$vaot8ALFLXuZNXaaLZnSlOKtytQs9XK6ZZe5twEouKcmYA96uqWt2

  • prc

    msaccess

    thebat

    sql

    mspub

    steam

    synctime

    outlook

    agntsvc

    tbirdconfig

    firefox

    wordpad

    oracle

    visio

    infopath

    ocautoupds

    dbsnmp

    ocssd

    thunderbird

    isqlplussvc

    powerpnt

    dbeng50

    ocomm

    mydesktopqos

    xfssvccon

    encsvc

    excel

    mydesktopservice

    winword

    sqbcoreservice

    onenote

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6861

  • svc

    backup

    mepocs

    svc$

    veeam

    memtas

    vss

    sophos

    sql

Extracted

Path

C:\wmlc5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wmlc5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F59C2450388DF59 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/2F59C2450388DF59 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2TJBJzt/SRHMFesFl7ERKKZvZINAtrBOKUYB67E6+qLJ9DQH3kq9eAccfeonloWj b/LT2bCxj9RuaOl2hgdHj753kPx9E5LEibL8fJkFGUwCStU5VnOh1uFHO4IgNrLB HQ+8Mv0noo9aKGv7P6kLSAoMo7aVZEBHPBzULt2wm6RWwnUuAf3tlKs3TqMBtEfG apH3JGzrJfIWuyBxdRTq5S42Z2oaEXRhbROi8FhvJwAD1DatPS6ynZsH+iCxpa9q 3V+bGsqbVJk7n0S273EU77NBI1D9sTEcRevgdbT+V6nZEGXWKaexIAJMkGova98f wfIIRg2Muwtjt1ZpGIla1ONDpDtTMPnN3g2CRftlLXhJHzXmfw8MhcUzeIV4kik9 kpQwhkiLM0xKMkoCw6ZUQPAumys4QV7Abnec9km5fkamUgTGhZCNhXY2s+fL49YT h+ZEpXTKY9cwdHXJ0X3zI5OtDhHVPq6T3yv+JAqRR0dbAJnDu4NutukaYMSFVdIf 9e1zOCGDpSC83KWHvAxpaqKaZLOSCvmM5UAXkXkBsls2i9618/I8QRsg9NUkwy/W 5EgaEDNs0sfyFsgjA2UbIKa04Fn07ZPf1yrMwWGCkpmLf+O6TwSMcQP6fsAJLZLj /u/uREe82ljvBtAJqp0y29CXur1G/z6ErMtUducdw5o1fnaFxa/jGGGQP2QCv0rJ O1B3xIxKvHoqUY09jwhE9bkSQIMibqyjUpdd68APLN5pj5qM/GpQQn9kehi4qA6B m4RozMsf9g0f2ynExlomHQrUfqqK2ukH+89/x9CeRR/lJhsJ7Jw3feBlThLg/aj+ Dox0iffvdh+0ou98PMSUZ9UF+oiaUIi3Mg33DxDuuQxUAByk76MvP1s6VpDcNv7I 0aTIdfQTnbWRphMouPWz2QhRR10dYpB0eSJNjIR5iPt93oKOKK4YLdUttLHqtPwm ztq3nzD3tulMNPNoeJs84sf6Z1ghSiTTVR+rskEZCUDl8phfHzjD1Nz0kpVtS4IA 0du89BVrgNHCw0aVKAMhKwemQ05gyUCuVmRPKnxmb+QaDfNaus/cVIRB/PL1Wmnn OQooA3xWR5zwwNdekZTrCiG1kIwgl4AL7fFO5qPBuwvRzgnyEt7H0tw9CyAijqcz YgyZ00R8d2iGU4iyenxwE9n5FgrdmwmfG4R8stWtGjjSIhWnJ5pVbNvXZheaV4oB TOert2EpW+m6IBgk7U1OR2SIYlIJp8tEu27PJredmy5I1GbywzsXiKqroIijIP5V l9xqQPXyhsdZE3q/fRnQD4yCKSQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2F59C2450388DF59

http://decoder.re/2F59C2450388DF59

Extracted

Path

C:\5e4p9xj2s4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5e4p9xj2s4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0908DB892CC11ABE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/0908DB892CC11ABE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9F75fO8wpuWNRFYS/0/pD9Gm0WC5uXLrri6YzZxsT0n8nCtYziSg1Yz8HRvkgoq8 03Vmpqt84/kfjFO57v315OBZziv8LnLiKgiBYmEV+qeahVczvA8CFDVkDH0gr1Bs cu65HTNBtjJUtQvp3uQwjfccuY76UbeiUIdsbgoPeyUuM5CnYRteS3NvlT6BS52w uf4TA4jzG1+nk+UxGK7aypJPY9XrFUUVs6+6y2OUcJu7rbwkBzomoecSEqdM2S7z xunMy8kNHHWRVAeCWFK8bzHpWi7ERwXkbsPcp4Qo/smGUQm3yY3sfQ1aeGYodnXJ QnpKRfQRHWN41JqOxAD/YJ3IovGMCV++flNj9S3TgsVSLO63ZR4NAyYPww+Fk/vB m5sPOuN9V8p8yKVibaBp0qeWeX6Af0cUaJe8pA1JqwXugzwDbq7/smEkvkYAAJ/u ou60vKhy3isYPmIWQWDrGlt2RSO4e10STrbwHhmxY2AkvKziGZOio6gk64GQIDtP DVj0GXqWc37YdwXyDGil48dp02u3CqfiEwOBFn3ZRl1B2ykPNX+Qe0ro1gd8MNna jFAPXm5JqgmhFzj+EXe/a0/aO+jBqg6HO2b3z6P+rlNU0+rmZJ0p41VctOgE6NfX 2wYVDZzRuB7rxh6S0ks6TSNt7f97W72Yld8d6Ss3glTHIcA+cG5bIc3LsCQO/Ty7 2uDF6NodfrPUq2FGO9uvyXsinhOPJcrgrifiRtUFJGwZyZ5J/h0nl3eUnXU2N6bk 8dr0pCp0N39TqPGZZFvxH5t82mGrBGS5heK17XZxmTE5yxkqiX95Jk5N5YNggTWj 75cxj5GCsShrs8Mq9iUQ9+ydBgPI2XmhHOTgvkTaUsZjb7iLVi62pzuDzDZMLJDG 56kwkZSFW/09k4iuu16s6150XEtkSz5cGV1A79wiYmCLVaJ/8v+8vfWGMq+BwptW WuVzUk76+Rj3KKzD1/v/yBLc/Yqm+KKH9qHxzLuUYZkAPjJb6iFrEzttY42bUs6l +ZPMutNUbH8PmLwedZylm5Hblkqi5O6ofw7MyEm6PcuuJck1kZaHDVwngoTwVT5t pGHZdcW6LFcM6PWYLlMyz2X0E/Gcv4f3s/j4L7EohlPbbP1GnEikrsE0wQRwfVTf csZ7bZUQOon4N+9G8bWojduKRxmVozEQiCMb5ebJmEDpOVEbpC91tuENrxf1Uzoq Lmc3hdxFCmzpeqL3kxbIOlvnS2/P7oT2SLP30ekt2HKbrC2xoL9CIfY67NWeAL3l JSTHPBLIE8HpX3dfNpQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0908DB892CC11ABE

http://decoder.re/0908DB892CC11ABE

Targets

    • Target

      c55646354dd7d92f9b3252c8b817baf22157610d9491dc7d0f299dad64d8eacd.bin.sample

    • Size

      122KB

    • MD5

      8a7deb28bf1fc0925142ef2f9bac9883

    • SHA1

      6e9d34c13f303ba3f4e5edec702383e3b293432a

    • SHA256

      c55646354dd7d92f9b3252c8b817baf22157610d9491dc7d0f299dad64d8eacd

    • SHA512

      3f9298131593033c439d99107290461370c675925213f39ba9ffffc626b9cad6e6e4f6efcd4c1d4761eddb7796fa6e36e1a519617176d53d10e551452ef00dea

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies Installed Components in the registry

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks