939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample

General
Target

939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample

Size

120KB

Sample

211020-pckalahhfl

Score
10 /10
MD5

9a24b3de7af3b2a2f1917e72e64da268

SHA1

783bebb04eda5a88851aa741133ae49c29f44415

SHA256

939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d

SHA512

631b8165326463749e8bb01e74304343158b4cd4c6c4e4a8e60922a298b90dab9c83c60fd69c4eda8ddf2dcf97c4040dc723f7e9beeb9a94aee568c30867044d

Malware Config

Extracted

Family sodinokibi
Botnet $2a$10$m5NsH9.kHWycA0s51cPH1.jeUjLDAAK5P6GAUDnLAfhMsJQGSUFra
Campaign 7089
C2

sandd.nl

webmaster-peloton.com

danskretursystem.dk

justinvieira.com

interactcenter.org

imperfectstore.com

theduke.de

digi-talents.com

innote.fi

collaborativeclassroom.org

atozdistribution.co.uk

elimchan.com

evergreen-fishing.com

beautychance.se

olejack.ru

devstyle.org

lachofikschiet.nl

slimidealherbal.com

henricekupper.com

n1-headache.com

charlesreger.com

mooshine.com

mbfagency.com

epwritescom.wordpress.com

waynela.com

seevilla-dr-sturm.at

toreria.es

nokesvilledentistry.com

tenacitytenfold.com

asiluxury.com

luxurytv.jp

architecturalfiberglass.org

handi-jack-llc.com

fotoscondron.com

zewatchers.com

you-bysia.com.au

tuuliautio.fi

flexicloud.hk

toponlinecasinosuk.co.uk

ecoledansemulhouse.fr

gmto.fr

corona-handles.com

layrshift.eu

funjose.org.gt

hihaho.com

gamesboard.info

em-gmbh.ch

pasvenska.se

nmiec.com

x-ray.ca

Attributes
net
false
pid
$2a$10$m5NsH9.kHWycA0s51cPH1.jeUjLDAAK5P6GAUDnLAfhMsJQGSUFra
prc
mydesktopservice
powerpnt
excel
encsvc
thunderbird
avgadmsv
msaccess
oracle
dbsnmp
lmibackupvssservice
mspub
kavfswp
Rtvscan
BackupUpdater
kavfs
ShadowProtectSvc
TSSchBkpService
onenote
dbeng50
ocomm
NSCTOP
ocautoupds
infopath
Sage.NA.AT_AU.SysTray
SPBBCSvc
kavfsscs
DLOAdminSvcu
mydesktopqos
AmitiAvSrv
klnagent
CarboniteUI
sql
isqlplussvc
xfssvccon
thebat
firefox
ocssd
dlomaintsvcu
agntsvc
synctime
outlook
LogmeInBackupService
ccSetMgr
BackupExtender
sqbcoreservice
tbirdconfig
Microsoft.exchange.store.worker.exe
BackupMaint
BackupAgent
steam
ccSvcHst
Smc
winword
visio
wordpad
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
7089
svc
AzureADConnectAuthenticationAgent
memtas
"swi_service"
SQLTELEMETRY$SQLEXPRESS
SSASTELEMETRY
Microsoft.exchange.store.worker.exe
mfemms
Telemetryserver
"Sophos System Protection Service"
Altaro.OffsiteServer.Service.exe
AltiPhoneServ
bedbg
VeeamMountSvc
Altaro.SubAgent.N2.exe
"SQLServer Analysis Services (MSSQLSERVER)"
SQLTELEMETRY$MSGPMR
HuntressAgent
"ofcservice"
MSSQL$QM
SQLAgent$MSGPMR
"SAVService"
sppsvc
MySQL
masvc
KAENDCHIPS906995744173948
AzureADConnectHealthSyncMonitor
MSSQL$SQLEXPRESSADV
TMBMServer
Altaro.SubAgent.exe
ds_notifier
VeeamDeploymentService
klnagent
veeam
msseces
LTSvcMon
MSSQL$SQLEXPRESS
MSSQL$HPWJA
"Sophos Web Control Service"
ADSync
MSSQLFDLauncher$SQLEXPRESS
"Sage.NA.AT_AU.Service"
MSSQLTESTBACKUP02DEV
KACHIPS906995744173948
Amsp
"ds_agent"
mfevtp
SQLAgent$SQLEXPRESS
"swi_filter"
"Sage 100cloud Advanced 2020 (9920)"
ALTIVRM
vss
SQLBrowser
"Sophos MCS Client"
"SophosFIM"
MSSQLFDLauncher
MBAMService
"ThreadLocker"
VeeamEndpointBackupSvc
SQLSERVERAGENT
AltiBack
"SAVAdminService"
tmlisten
SBAMSvc
AltiCTProxy
AzureADConnectAgentUpdater
"SQLServer Reporting Services (MSSQLSERVER)"
mysqld
ds_monitor
sql
ofcservice
"Sophos Clean Service"
mfewc
LTService
"Amsp"
"TeamViewer"
BackupExecAgentAccelerator
mepocs
VeeamNFSSvc
"Sophos Safestore Service"
MsDtsServer120
svcGenericHost
MsDtsServer110
AUService
backup
SQLTELEMETRY
AzureADConnectHealthSyncInsights
MsDtsServer130
ReportServer
Altaro.HyperV.WAN.RemoteService.exe
ProtectedStorage
SSISTELEMETRY130
VeeamTransportSvc
Altaro.Agent.exe
MSSQLSERVER
sqlservr
KaseyaAgent
"SQLServer Integration Services 12.0"
ntrtscan
"StorageCraft Raw Agent"
TmCCSF
sophos
ds_agent
MSSQLServerADHelper100
VeeamHvIntegrationSvc
"Sage 100c Advanced 2017 (9917)"
"SntpService"
McAfeeFramework
"StorageCraft ImageReady"
VSS
KaseyaAgentEndpoint
HuntressUpdater
VeeamDeploySvc
"Sophos AutoUpdate Service"
"Sophos MCS Agent"
KAVFS
SQLWriter
MSSQLFDLauncher$TESTBACKUP02DEV
svc$
MSSQL$MSGPMR
psqlWGE
Altaro.DedupService.exe
"Sophos Health Service"
SQLEXPRESSADV
"ProtectedStorage"
kavfsscs
sophossps
"ds_monitor"
TeamViewer
ThreadLocker
MSSQLServerOLAPService
Altaro.OffsiteServer.UI.Service.exe
MSSQLLaunchpad$SQLEXPRESS
Code42Service
Altaro.UI.Service.exe
"Sophos File Scanner Service"
macmnsvc
"ds_notifier"
ViprePPLSvc
AltiFTPUploader
"Sophos Endpoint Defense Service"
VipreAAPSvc
DsSvc
"Sophos Device Control Service"
"StorageCraft Shadow Copy Provider"

Extracted

Path C:\ts2xy0l3l-readme.txt
Family sodinokibi
Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ts2xy0l3l. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0664ACFC4FBC4553 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/0664ACFC4FBC4553 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mFOhI222Qxvx3pnLALCNtvT4FAHhtbQZ70NflgIwEGm3HDRU4s0l5NOOdk7jg5Ma 8JJHGHJZ56lIMnFdMe3BXI6elvmGQkL66VS1Evb8aFFw+JbR1OCP+ubHFn4FVC9g 4E0W/uehwEsHem7+htG2xi0nRWJdM6xLqtIIDkl1z9DLp2ef8o2ZEdznuHgxOsjv r/lonxMFh7SQnXDeq0QhxoS7HcQzshSZWOl6eAzDR219+4Wn3PE8n+pqz18GpLtd bsJUjc9J8ez4aGfBKKaJItsNOEHe6e9VN8FzeI/ooDAkzEVUoDbSNSRiej82sSpP qn5fu3HngKqdaLmVZHDAB0gR18pG1uoJq37kOY4NPYvVoJVapYXiDTZUn9Sq9kU2 FsYxzFwAr6HfJh3e+/6dzP42m6m/jmTD2xnO9BoYIOP4BgSkwSoc/NaHYJEH/j8N USqldaPcGTiI4D7uhqU5Y1U9nMtfUSCUFnWuF5E0H4PlzSKSwCho2WHjbWPa32O8 vr+GhQtSKxKY3JgIs20fhjP5EYTj5nuHrxbfrK6LKrA7A+eNKyL6hs8uCTcQRVKf Gds+qjQ/2VR+sDAMnZJdC892/T8Uw6GHb2NZyS5em9ptUE7vLQuP+kf7lsRvnNMq 2jaddJretqHhFlAQ5+RqgnhQBZ0sQyo0TNqbcnF1cIoLLLvwiSxQJhQ/zLdN5Ie3 r9CdoZqXYcXfN2f3NBnZwEm7Sfx43gWiEDqFV1tnTf1ojIOdipjCU/ORi6X99wwh lVsIhRweTOQvMX920B3RZPOZRwSBzBjyj3ZbW7sNOt89adXn5vVxFo4s0z3tF4Bo I+ODqfDCaZW+KhjJFTV5ItEZ4MTViPeBY8TgiDJGxGPqViG/2wR+bJFagG3rMGE6 CMrHOTJyBSC1X9dUphlTdcgWpXGoInnTCf8lPdzM6PKJaUPHOou98wQSrQBYDlr8 NMCx9IH1z/rRvHXeCWKgKG69/VaiwslhRcNJyGmL2ZJ8PLJIB4lScugAiWT417Te OeiwiUukq9kdJUeqoPJL34ssHdNih+3s5ReKdQSV55Crhso6PsUDTvBA2c7u8s/r gkYvq0ILUDR/5Ro7oU/gR2Fk2xkwoWILrsS3hRjGwTa8b4mD5Zix9ib85+c9QDEk fMv8gRcHRowD+Kt315OtlgAPxZK6p8em89ug29qFGcBpxv6XgB4sZCM+Mas8wLQC kkOCeM+CGnGGdjZts0KzqyWCgMjHNo5FBx6kjnfhe0fI3WiY2Iu9F0hjQUnJTCK9 4XFR0pQhgX+PWW7A ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0664ACFC4FBC4553

http://decoder.re/0664ACFC4FBC4553

Targets
Target

939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample

MD5

9a24b3de7af3b2a2f1917e72e64da268

Filesize

120KB

Score
10/10
SHA1

783bebb04eda5a88851aa741133ae49c29f44415

SHA256

939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d

SHA512

631b8165326463749e8bb01e74304343158b4cd4c6c4e4a8e60922a298b90dab9c83c60fd69c4eda8ddf2dcf97c4040dc723f7e9beeb9a94aee568c30867044d

Tags

Signatures

  • Sodin,Sodinokibi,REvil

    Description

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    Tags

  • Modifies extensions of user files

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Enumerates connected drives

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery
  • Sets desktop wallpaper using registry

    Tags

    TTPs

    DefacementModify Registry

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Execution
      Exfiltration
        Impact
        Initial Access
          Lateral Movement
            Privilege Escalation