General

  • Target

    20646f66d68edcb55b857cb32d5d4aa76c854fdab4ce74e6ff007828f81b2653.bin.sample

  • Size

    164KB

  • Sample

    210910-nh736sdban

  • MD5

    111d4186c975d1fc915e2e2766dc1ab5

  • SHA1

    351c1aaa7ec4bb28e9041a9a163008de8462a5e3

  • SHA256

    20646f66d68edcb55b857cb32d5d4aa76c854fdab4ce74e6ff007828f81b2653

  • SHA512

    d1ac97bc780ff1e2f6e59c6107b8fa779701103de540ccc7cfc4d3ab38a67ee6b04298733fdfac810bbfa8a13a2b7c3e1215970570872ebc6eb02f49d100e024

Malware Config

Extracted

Family

sodinokibi

Botnet

38

Campaign

467

C2

wallflowersandrakes.com

craftron.com

lagschools.ng

epicjapanart.com

greenrider.nl

motocrossplace.co.uk

chris-anne.com

claudiakilian.de

afbudsrejserallinclusive.dk

dayenne-styling.nl

5thactors.com

casinodepositors.com

awaisghauri.com

latableacrepes-meaux.fr

sunsolutions.es

salonlamar.nl

martha-frets-ceramics.nl

akwaba-safaris.com

inewsstar.com

vitoriaecoturismo.com.br

Attributes
  • net

    false

  • pid

    38

  • prc

    firefoxconfig

    isqlplussvc

    thebat64

    sqlservr

    mydesktopservice

    sqbcoreservice

    excel

    sqlbrowser

    mysqld

    wordpad

    msaccess

    visio

    tbirdconfig

    steam

    oracle

    mysqld_opt

    dbsnmp

    sqlwriter

    agntsvc

    synctime

    xfssvccon

    thunderbird

    outlook

    winword

    mysqld_nt

    ocomm

    dbeng50

    powerpnt

    sqlagent

    encsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    467

  • svc

    backup

    vss

    mepocs

    veeam

    sophos

    svc$

    memtas

    sql

Extracted

Path

C:\j24g9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion j24g9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BB5D4BB8C3691E02 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/BB5D4BB8C3691E02 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: j6m1rELjIufApv7fgvWBXlskeFc04AyDIH9x3mT249wZXH+pYfGqGVld6R3f7nGh eE/Rcld1V/csmrk/aP7Km4u5UOizQzWjLPk6dREgWzIKXXdJqdmQVEj2/bN8V5DD KG54ici9LPzsG9hMPCZfc8qPM0G8+zjLH+K3yZPNHM7XWuTLmZBQRLbdZe1nwe7n tUECGTfvZ9TAM7uxn5IEI5k+suJYv8z8k+OeXc20RJ4f8B8Bes2E7Qna/5j6Bg5Y rSUm3ffqR+WTWki1gR+Z0eL/4yZtmGHzROulXsmeLFsx2JfqI7bPiBsWE68vFJiX Ye/l2uT7in+92lpuCO08ytDa5Un+83MY84Yj7naEmp8lI8iQuyuamN02oolkH7rG kUpxUIJzRiK8NfkQfurzjJvrnyZ7TbiVAt9asjqSdr/o5Zb+sHq4Z01Z2B6Wuav+ vqbY1xRLUc6UkVHscf10QFmvRWvFbGXGLcj8DWy66Q868HQvu9F0PTN6Qr5532T6 46HJNgr6qDv3vQISYgTPbnB4rut0p3BWhcWeaOOuuznXOjoZm0Xd9F4+ZwHJhjZO FVPfLDtZkJGjh5XBh1ljL0NPdUf/CLMO3G6U8M8dfguBBRh32yUDFdiV0JHrlweL E/d8ww2QhHh+bW1pHyYTlG42eh/vA8Zh3rb2e2hf3F+ZLrtciqkHIDrFmP+tnKcb kasP95BYV6ygqnLQph5iK/de9zKn4qtBDEeF5JEIPIe0tGOzTFriWciO5U8KKMBO Y4YdQFY3qRICKQkv3HmQkl750cJKDUFSWJBR20iEoesVpyYOgMi7qfOY0ajcjzxG +2kahBnVy8bwFPEPvLTy4a03604B+uobSbvBW5J4BOZUnniioidspX8HIvfKvGbX OpGUBmVNpMD6L3aRdpcH96pY/cbnaI6OxSYVkwlYNpXcP4MdfaTT1IkJT0dXIekI ZiJv6jk04lT0XhnTp3HSFqQ8JfYgkAGpuSc2BUJFw/gM5blHH1PRBWiLyFzLiNpX 1yQOpWkfuObdLeY56CEI/t+YsLcDmT+BBDRMt3DoaiBwyAKoX3MwIzatO/0UxGGC b9/ljziqU2tIiMc6/KmDtChQTwlAmLoi5CewrUWMsVxfNWvvdUet7g== Extension name: j24g9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BB5D4BB8C3691E02

http://decryptor.top/BB5D4BB8C3691E02

Targets

    • Target

      20646f66d68edcb55b857cb32d5d4aa76c854fdab4ce74e6ff007828f81b2653.bin.sample

    • Size

      164KB

    • MD5

      111d4186c975d1fc915e2e2766dc1ab5

    • SHA1

      351c1aaa7ec4bb28e9041a9a163008de8462a5e3

    • SHA256

      20646f66d68edcb55b857cb32d5d4aa76c854fdab4ce74e6ff007828f81b2653

    • SHA512

      d1ac97bc780ff1e2f6e59c6107b8fa779701103de540ccc7cfc4d3ab38a67ee6b04298733fdfac810bbfa8a13a2b7c3e1215970570872ebc6eb02f49d100e024

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks