Resubmissions

23-08-2021 11:13

210823-gdvketlplx 10

29-06-2021 08:46

210629-d63daj1whj 10

General

  • Target

    c55646354dd7d92f9b3252c8b817baf22157610d9491dc7d0f299dad64d8eacd.bin.sample

  • Size

    122KB

  • Sample

    210823-gdvketlplx

  • MD5

    8a7deb28bf1fc0925142ef2f9bac9883

  • SHA1

    6e9d34c13f303ba3f4e5edec702383e3b293432a

  • SHA256

    c55646354dd7d92f9b3252c8b817baf22157610d9491dc7d0f299dad64d8eacd

  • SHA512

    3f9298131593033c439d99107290461370c675925213f39ba9ffffc626b9cad6e6e4f6efcd4c1d4761eddb7796fa6e36e1a519617176d53d10e551452ef00dea

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$vaot8ALFLXuZNXaaLZnSlOKtytQs9XK6ZZe5twEouKcmYA96uqWt2

Campaign

6861

C2

shiftinspiration.com

gasolspecialisten.se

gratispresent.se

epwritescom.wordpress.com

drnice.de

bricotienda.com

associacioesportivapolitg.cat

nosuchthingasgovernment.com

team-montage.dk

body-armour.online

profectis.de

drfoyle.com

faronics.com

myhostcloud.com

parkcf.nl

colorofhorses.com

lykkeliv.net

smithmediastrategies.com

bookspeopleplaces.com

psc.de

Attributes
  • net

    true

  • pid

    $2a$12$vaot8ALFLXuZNXaaLZnSlOKtytQs9XK6ZZe5twEouKcmYA96uqWt2

  • prc

    msaccess

    thebat

    sql

    mspub

    steam

    synctime

    outlook

    agntsvc

    tbirdconfig

    firefox

    wordpad

    oracle

    visio

    infopath

    ocautoupds

    dbsnmp

    ocssd

    thunderbird

    isqlplussvc

    powerpnt

    dbeng50

    ocomm

    mydesktopqos

    xfssvccon

    encsvc

    excel

    mydesktopservice

    winword

    sqbcoreservice

    onenote

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6861

  • svc

    backup

    mepocs

    svc$

    veeam

    memtas

    vss

    sophos

    sql

Extracted

Path

C:\p8e25uzp4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension p8e25uzp4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBBD40218BC711C8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/BBBD40218BC711C8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tx/2uuIjxuUBzpTrTsla/9Vc+T2jLyivqlmtUFkL2B4M5PSIQXcIPa66Qv7R3fYH uPTWcBgEH6bf7SZIy3ATr5Uc0hhgYye0s+x7/t5U9rgZurEe55gCc8FeYmcj9Cyw gIFXrpaVH/8WQEe9KNRfkeGIgH5OPxKvewsbcr1agrUfgYrcSgo+XePHQQI32xTU 7RohPmeYPTchevfsNxfsg/wcxUdof1Eu1iBw3g3TIUTM5VEYtClgdyFrbZFGFSTG 9zK1DcIetlKZXdlcltNLH/LsIIGPGc98G+KFJ3HcXbXGQKi7A/t8lU44gl8Ss2vX 6H3fbHxSFyOVEnTfBYo33E4d5UC5SPFbVGapwNuZiP67AEg3zVletaxSfzFjsj9P RVxqpP4igwkI3xDlxSpIJf0a5yM5Crmm6mXxb4gRmIvKcegkoCLoxO8FERs6XkaT hZqSJiSHNvmxnE1gI19CQtRqcAYTO9aB6iW6EGYRJ/uW4X773ABdk9B+T03hm/+I 98C7jj1uVAcfV7dMw4eNWGXg8riz9lC+T37N5rRphPNSHz00RDpju0nChKaenpZW As8rfo0r5IcQ7sKlkMNj4YzGJIP0YJi6w3wApQ65iXs4TyjAkXTDGNVDpuCyvrBs tmML5TKQJbEqP3zSgdAdxXNiQL/cBAOsL5c0NHBADml5rwnAISv09B1BSFhGwej3 ihznz3aJ4iFo93+caZ/z4rAaeF3BqnMBeoVjzKqcFZtC/KOFplIcY7GpGBqNAebR 3zITM/FjUh/o379L1ygljoFCqraO2quqheMbBCTJUveKjc9QJWrs5zRWGdtBiHlt X+0bZPYruGWEpQhpV80GRJ3R6ITDKs855Fn7J0wOeFoff/JHRzw14ly9rcdi7h9d xfPw1+3LWbBk40eAcUvMEgDmMA7sBqY5f8iuHeCGiiz38GAjCt5rZi0IF7RWPM2r /dmp2hs03vFDB/1jXMnU0ypMWUIxOkCHA+mX95Nhq7sZvCQIWHKo0u+Yz3Xa3xa3 4Vl9lQNRCSweLDSn8OkiS8+E0QgeyC1pOvpb/X9R07tcL79VGI+/gE4zMQLCjZLd Qs8cJkRwRrVWrQBlayLiD7yCs6s1QPC9D6BCXNUFETtWenEMFjSNbyAN8rq/vyDu w2gmtm2KwQUkjNqlUhyhCIyEAjbjEcabZbd0lqM9CGX4wZXYL+2w20rCkby/GW7K Y9vKbkzjiYLYyjxTOoyKRy7It9J3YUj343hvGwYZW6BtV87brigG208kxZkLXP6t fWxlWNhowW0TNOXNpIIbcCTnD1/VtJrKVZppXA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBBD40218BC711C8

http://decoder.re/BBBD40218BC711C8

Extracted

Path

C:\j953co8562-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension j953co8562. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/60FB08DA683F01C9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/60FB08DA683F01C9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Drnn/+VsgOxqfM8eJCrT2ffxN8nNymcf/zC0DgLWlzhT1R7xkV1yFFz4hleTYkvU 6eBdclcNN8MCi9KcWCko+/rHUVoTlhCVyDqyVe4X9Pmdhnxi+OUM2s0ch/3wjfis AqpCNo4E6znwlbTCWZj/YgJhr2ydYIUxDzt37OJ0ZfokNaxVZecJN7RG0olD/4Rh OxMt6WGiyaoF445s+0I0uK01NGxRAQHz1D+KBspxZTDCWD24KqKATZbe62coxwa9 hedxksbPcS0igK/EeNoKkYtEb/GPhBGe4Il7X/aP87xVVWluoE8A3mcE7jDxpxp7 tpGvH/O8eIkGeT65R4YFBccX4P+0uf0SRVDCPtnjwzXAckDU0n+j++Xvnn+eolSq vlspE+VnxQlivZpVn1D4CE4bkPbb6BUniHN5X8/c0T8PZ7I0sqXS4usrgIACNRt8 9VF0x9OxJTM+5jlY8Cxp27gSWJwnK2qI++l9Lom1r56Xv5s4ofwd7SvWv1jmx8/U 5vQHFGDHj5Kj+VqA2BmybQ8ksAnPuskLz3Q8m6e7b55Z3ez3QmyA6jPs9XoTMm8r wNOzFw1HvXWb6kLxIOeqZWWU0En3lRagf4WvglGEMKgy4IWwuTwwJkU5agPLL8zT 8VSmq7ttGoExuDeTTLb5mFfrTtzwzqlnRrzHzjAbfIuv4HeV/xAmvDLbOUGvnQJG +PjJnlEgAAKJp49I6md2RDEHqN/8Ph1rcchXzMmLm8cF7+naEuafIxLNzcWJVZgo 5y7oRnxdEr/nXYyX8o+8v1aL+H7mz4l7GV5p2n3mF+9P9lTPUyJFXgk8YzTF7ZMO DVx95bX0cxIoCbHgt8ff4AxCp/aNv1iJIGGIKNVMM2GIC7+pfvDxVh6dh0gmpM2T hmZQ1TFH5QcND8ehsNLEET5aOy3EOsToi0VQDYC2ZoO+VlZ473ZlESycgrC6DxTs W4R2tUX8RYeP91TBmHgaHubCgePYVdks6sFtWsrXxiR5949QuYHVjWFjD/BgGO3p odfjXX2akRXDc76Y39S8KKfMWFtHZMi0yPI+EhG6Nf1gNnqguVEv2btn2n7fgqjz 2fvrP4GYYXT+CRfzG/d1VuQinhfmPhjRHAHdwaqIAGhMj5v66og/L0KaGoZ7m/5j PnSEzw33iUeAP94vTCE/BOFnW8V3tduWTtO3U2wWe/cowPDKX9CoMyfKnS4OjKid liCUkPLz60147wnT3+Phf/HN2Jtq23jag97XEedpAcG1LRuvIh2kEI5eE4lIau8b GLFTDUWCbPcVgTI2m74= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/60FB08DA683F01C9

http://decoder.re/60FB08DA683F01C9

Targets

    • Target

      c55646354dd7d92f9b3252c8b817baf22157610d9491dc7d0f299dad64d8eacd.bin.sample

    • Size

      122KB

    • MD5

      8a7deb28bf1fc0925142ef2f9bac9883

    • SHA1

      6e9d34c13f303ba3f4e5edec702383e3b293432a

    • SHA256

      c55646354dd7d92f9b3252c8b817baf22157610d9491dc7d0f299dad64d8eacd

    • SHA512

      3f9298131593033c439d99107290461370c675925213f39ba9ffffc626b9cad6e6e4f6efcd4c1d4761eddb7796fa6e36e1a519617176d53d10e551452ef00dea

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies Installed Components in the registry

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Enterprise v6

Tasks