Resubmissions

06-07-2021 11:36

210706-czh1m88q4a 10

02-07-2021 21:10

210702-71mjgfl1kx 10

General

  • Target

    martinhal.exe

  • Size

    122KB

  • Sample

    210706-czh1m88q4a

  • MD5

    c3afcdffa4aeeee56b80cf2fd3c9758c

  • SHA1

    e405c212107696a579494a67531ca5877956fac0

  • SHA256

    9b46d03b690bda0df57c0ebb8dae0aebdd1d131beb500242fa8fe59cb260eed1

  • SHA512

    3a984d836176b14d16ac0106c11ebd37f8d7343668e8156d33d74fc721e4224efadd1cc2ae22b3630bcf181eb077a55c571d9f670dd1552905e1fc4605b51346

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$wbJ/jJsirdrxyDAHiIWYae.9jY8aqWe/s.JXkf0rAbaiM8Pd52U3G

Campaign

8309

C2

arteservicefabbro.com

answerstest.ru

geisterradler.de

embracinghiscall.com

haremnick.com

bodyforwife.com

dareckleyministries.com

marathonerpaolo.com

servicegsm.net

marketingsulweb.com

DupontSellsHomes.com

handi-jack-llc.com

naswrrg.org

amerikansktgodis.se

dlc.berlin

schoellhammer.com

caribbeansunpoker.com

houseofplus.com

moveonnews.com

grupocarvalhoerodrigues.com.br

Attributes
  • net

    false

  • pid

    $2a$12$wbJ/jJsirdrxyDAHiIWYae.9jY8aqWe/s.JXkf0rAbaiM8Pd52U3G

  • prc

    winword

    xfssvccon

    outlook

    firefox

    msaccess

    ocssd

    tbirdconfig

    oracle

    thunderbird

    excel

    dbsnmp

    ocautoupds

    mydesktopqos

    sql

    onenote

    sqbcoreservice

    infopath

    isqlplussvc

    mspub

    mydesktopservice

    agntsvc

    encsvc

    dbeng50

    synctime

    visio

    steam

    powerpnt

    wordpad

    ocomm

    thebat

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [-] Whats Happen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    8309

  • svc

    sophos

    backup

    vss

    svc$

    veeam

    mepocs

    sql

    memtas

Extracted

Path

C:\6iu4l9w-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6iu4l9w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5D63CC5BB219DA3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B5D63CC5BB219DA3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ye6h3JmS1/n9dC4KDtwRkya8kbz+57gHekrTo2uyGID+rLrcgJdHEFdCsZVnXryj UD16bIHN30+LqhG0hwklpagEoSBbQqTJF7KEXUSCVJJ0cmffr+AWJ0LeSZXvR4Q2 2xqrfxrYvAofcadovFGcl2e6ekPc6o02y2p46jOZcyYJmPR3EvYnDvbJhzwp1ERQ vJOyhcaWwTIDzsxFpAbQ71obZt8XZWLoYkvXxlnHsk9vdyn7L+avfFh0Hrf7oWwM J33K4CZfE9yIbr3DkLOj+SQ8VcZw98TUjz6FUjm8TMJ56i/QMcggZVGY2QgtBwjK P1LNRZ0+Hzo+7A1U62Pida0z1sF28MRfMEVNEAfVLpg19j9rJ3CC2c3sA0azQ0QN Zh/1RMwcTXGlPtjikmMKsBE0+WAKI3WvuNLG35GiNnibQJJXp6wDn0eMaPgypEGp J6p2X/OPyWymm5oyLgeJNq13hwQcOXiBlmECG0CIXEslAUreNaZbxvs4W3B4D/Cu prrcnEXiQdzeAw2wkydidPqDmO2hp5IHqyAIJuaWWtKsWQknPTmlQrLpEj3j5S8Z dVrLiZJ6Fh1Y/f749C+qByXQowGXb0lKG7rhDUeBPMRaYAyKXdHGOkXKXgEcvVQu kovd4vHTFFEn3B9o92mad7/nPFVOu/FKdARWHoeF0Ap9/y5yH4HJOOBG9sW/PzId BknbUSHMpWfGndw55j4SsS5HQgDy5QzxpE4uLWTmaoYOgAQ5ehGx2HyjKO1cyJIy QiKt2llggnN20n5HuFXE3mr7Wua1YSd7pz9hnFAB1tcY5L2hdGh5pYdW868eu/fN NE97WMG4NtwJNmUZzwQ0QbuAxAfv9cNaq4UAzuLBkVymdHBP+My5YV0CLqpw9JtH F3RsjPUdBYIhFaZ9aiIm5x7HmvnsJWGkZ0v3IK3BbZzagK02PE69uJDdQwEsBi+B irK4kKu6ZmegOyW4lD+1DFxWhomc7eqkyi3RWFOqw8Ln+I/lMmj7UPb5tjJqC2ff w7104A32gYW2tsiDmRscb4uHjHFy9wU019XQvfFLpfJ+4y8XU3ERU7zz7s1bzQvA ipbEjPnGvCzf7fOwf8IyC8xYewvCX8EjXJBhSSgiZBw54j4zrmFC6sk+wlm/9uld T620qqGFo569c6Hy6OJ2WQjJPTk5e+zg6R0Y0HHRsVJpvQ0hlGOlIEx57Dtj7Ev4 sh21m8wwaF7qye2bEdF/lew5XkOlNrGNIJ6WpW9cslJFb6cWcKRBR/0N8w2jAA+o 9w6LjZlL3YQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B5D63CC5BB219DA3

http://decoder.re/B5D63CC5BB219DA3

Targets

    • Target

      martinhal.exe

    • Size

      122KB

    • MD5

      c3afcdffa4aeeee56b80cf2fd3c9758c

    • SHA1

      e405c212107696a579494a67531ca5877956fac0

    • SHA256

      9b46d03b690bda0df57c0ebb8dae0aebdd1d131beb500242fa8fe59cb260eed1

    • SHA512

      3a984d836176b14d16ac0106c11ebd37f8d7343668e8156d33d74fc721e4224efadd1cc2ae22b3630bcf181eb077a55c571d9f670dd1552905e1fc4605b51346

    Score
    10/10
    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks