Resubmissions

14-09-2021 08:43

210914-kmnzbafdd3 10

06-09-2021 07:34

210906-jd4sqsafg6 10

General

  • Target

    1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

  • Size

    910KB

  • Sample

    210914-kmnzbafdd3

  • MD5

    18786bfac1be0ddf23ff94c029ca4d63

  • SHA1

    3c2b0dcdb2a46fc1ec0a12a54309e35621caa925

  • SHA256

    1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

  • SHA512

    49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK

Campaign

7595

C2

hiddencitysecrets.com.au

groupe-frayssinet.fr

rimborsobancario.net

vietlawconsultancy.com

live-your-life.jp

verbisonline.com

sachnendoc.com

htchorst.nl

bridgeloanslenders.com

petnest.ir

myhealth.net.au

gopackapp.com

jenniferandersonwriter.com

logopaedie-blomberg.de

osterberg.fi

bierensgebakkramen.nl

refluxreducer.com

thenewrejuveme.com

alvinschwartz.wordpress.com

leoben.at

Attributes
  • net

    true

  • pid

    $2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK

  • prc

    firefox

    mydesktopservice

    xfssvccon

    infopath

    visio

    encsvc

    onenote

    ocssd

    ocautoupds

    excel

    agntsvc

    outlook

    mspub

    iconcerto

    wordpad

    sqbcoreservice

    winword

    oracle

    thunderbird

    ocomm

    mydesktopqos

    steam

    dbsnmp

    sql

    synctime

    tbirdconfig

    dbeng50

    isqlplussvc

    msaccess

    thebat

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7595

  • svc

    memtas

    veeam

    sophos

    sql

    vss

    svc$

    mepocs

    backup

Extracted

Path

C:\wmud76-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wmud76. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/51698AB1F093DA0F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/51698AB1F093DA0F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: CqOedJvR3RjzNgReTn951nev0Ui5rwoVJwVTIt+F6WS+ULYqUyciB7+kno8knYq4 Dvw+DQilkh8Hi2SXf2MvRhCkoB565g0I/BvuBh9HBTFybZ58H+Ow8Ms24s72K052 SazvtPGMI3+VFaasrY+RBM8GKq7yR4qI/e5G4eqOpcMgA92EglExLBefzKtetKSX kLDu1ajtC6e1VqO+N1IlwW/WYrC1AI6i22wD1hJXlOsPiITF9hJZT6PcBnVqFbHJ pYXFsfyDsJ/uQflXznxODJY20mKdLdb6fD8G8iJHwNPd+EB3y1HToH5lBkIdtTBQ VSQ6HspXqB41qZKXbyHi37vxnDtu8SAeCjZ58he6E2SgeX2aRIoN66s2sXJf66P7 AQkDeYQwfBbEDXqegQRiG8vpS6EQkpd8ko//lohtsK9HOVFmC7lXRlsDeOpRGGrw KtqLMcp4HAxoWD+Kh1t+/ewFlK9qyyXbyFOsW4ASSGrxLhOlSYw+bpOvdvblgO8b raqHgW8uaXpgvtl5xCCe/Ae+Vx+Y6gZA72Bll9KytCySD3y/fDvzAfIBqJj6Ih09 yV+ubdTCcas3iN4d4d80toY7DrNyqd4RbHBzJenwgeEYTUkO4+8/j4nuW0Jv44UB 9StGyyiMJ5EAVyFz4aJx5ia2zn10ivomCBZ27IexKwr3+Z7s6Mv/tXnNnA8fx/fc m67BdXWPsxPCkXtVJIdGTKt8i+xBHEEF4zFcx6sTvXaBH/W7fNgABqEsxGhOMHqK o46Kgl1k9dpSEUCY15EzXRejvwpFo9UhDOzb0X7/b6+wHkSEAGpokJXWYHJP5gS9 4b8LleBpN6MviXo7kNrk7ablEV23PIW5PNM8Ig2ve2rJq9b9ncirGs6Bf0zxcLZI jzdxmEe12obIRARkjubDLY/1wR/B3YEEm783PrT4smONYFd3LYR7nhElaG3LBdkq lb/B9IAYkNwi+WdF9u9KueOJJW58p4wOhWvj7x/ViHsMr2WZPhrbrAXfEfAtHuwx LdfnzIzVJusvi6NMS8l6G5d+Q0pWm8OZOErwMm/2JuaoubemP+UGWinm0EJ9GnMR GGw5/X71q3e1Ybx/ERh028P54wq26vki6k0Ws+zivWiB9HpL/GUnsO16mRiVDTOf VSHkUXeChtV4giNVJqAf//sJBfgiu/SeX46KhcDU6tsVAy0VFEC/2c9uQ4NCH220 zNN5Xv5dn2/VvwU4cCYV9WjeT8VR+VYAxzvK9C6k7Kx+IzpDiZgZ9d6BSME97sgR h+HS90oT ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/51698AB1F093DA0F

http://decoder.re/51698AB1F093DA0F

Targets

    • Target

      1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

    • Size

      910KB

    • MD5

      18786bfac1be0ddf23ff94c029ca4d63

    • SHA1

      3c2b0dcdb2a46fc1ec0a12a54309e35621caa925

    • SHA256

      1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e

    • SHA512

      49c9af2b357df516ceb2841f7f3d7554ea9fabe219e40ef555c67fef9cee239e73d995ff069c8cc20fa09749ad6adfcce56f6922011929b4dce5d09b5860d48f

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks