General

  • Target

    939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample

  • Size

    120KB

  • Sample

    211020-pf3w4shhfn

  • MD5

    9a24b3de7af3b2a2f1917e72e64da268

  • SHA1

    783bebb04eda5a88851aa741133ae49c29f44415

  • SHA256

    939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d

  • SHA512

    631b8165326463749e8bb01e74304343158b4cd4c6c4e4a8e60922a298b90dab9c83c60fd69c4eda8ddf2dcf97c4040dc723f7e9beeb9a94aee568c30867044d

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$m5NsH9.kHWycA0s51cPH1.jeUjLDAAK5P6GAUDnLAfhMsJQGSUFra

Campaign

7089

C2

sandd.nl

webmaster-peloton.com

danskretursystem.dk

justinvieira.com

interactcenter.org

imperfectstore.com

theduke.de

digi-talents.com

innote.fi

collaborativeclassroom.org

atozdistribution.co.uk

elimchan.com

evergreen-fishing.com

beautychance.se

olejack.ru

devstyle.org

lachofikschiet.nl

slimidealherbal.com

henricekupper.com

n1-headache.com

Attributes
  • net

    false

  • pid

    $2a$10$m5NsH9.kHWycA0s51cPH1.jeUjLDAAK5P6GAUDnLAfhMsJQGSUFra

  • prc

    mydesktopservice

    powerpnt

    excel

    encsvc

    thunderbird

    avgadmsv

    msaccess

    oracle

    dbsnmp

    lmibackupvssservice

    mspub

    kavfswp

    Rtvscan

    BackupUpdater

    kavfs

    ShadowProtectSvc

    TSSchBkpService

    onenote

    dbeng50

    ocomm

    NSCTOP

    ocautoupds

    infopath

    Sage.NA.AT_AU.SysTray

    SPBBCSvc

    kavfsscs

    DLOAdminSvcu

    mydesktopqos

    AmitiAvSrv

    klnagent

    CarboniteUI

    sql

    isqlplussvc

    xfssvccon

    thebat

    firefox

    ocssd

    dlomaintsvcu

    agntsvc

    synctime

    outlook

    LogmeInBackupService

    ccSetMgr

    BackupExtender

    sqbcoreservice

    tbirdconfig

    Microsoft.exchange.store.worker.exe

    BackupMaint

    BackupAgent

    steam

    ccSvcHst

    Smc

    winword

    visio

    wordpad

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7089

  • svc

    AzureADConnectAuthenticationAgent

    memtas

    "swi_service"

    SQLTELEMETRY$SQLEXPRESS

    SSASTELEMETRY

    Microsoft.exchange.store.worker.exe

    mfemms

    Telemetryserver

    "Sophos System Protection Service"

    Altaro.OffsiteServer.Service.exe

    AltiPhoneServ

    bedbg

    VeeamMountSvc

    Altaro.SubAgent.N2.exe

    "SQLServer Analysis Services (MSSQLSERVER)"

    SQLTELEMETRY$MSGPMR

    HuntressAgent

    "ofcservice"

    MSSQL$QM

    SQLAgent$MSGPMR

    "SAVService"

    sppsvc

    MySQL

    masvc

    KAENDCHIPS906995744173948

    AzureADConnectHealthSyncMonitor

    MSSQL$SQLEXPRESSADV

    TMBMServer

    Altaro.SubAgent.exe

    ds_notifier

    VeeamDeploymentService

    klnagent

    veeam

    msseces

    LTSvcMon

    MSSQL$SQLEXPRESS

    MSSQL$HPWJA

    "Sophos Web Control Service"

    ADSync

    MSSQLFDLauncher$SQLEXPRESS

    "Sage.NA.AT_AU.Service"

    MSSQLTESTBACKUP02DEV

    KACHIPS906995744173948

    Amsp

    "ds_agent"

    mfevtp

    SQLAgent$SQLEXPRESS

    "swi_filter"

    "Sage 100cloud Advanced 2020 (9920)"

    ALTIVRM

    vss

    SQLBrowser

    "Sophos MCS Client"

    "SophosFIM"

    MSSQLFDLauncher

    MBAMService

    "ThreadLocker"

    VeeamEndpointBackupSvc

    SQLSERVERAGENT

    AltiBack

    "SAVAdminService"

    tmlisten

    SBAMSvc

    AltiCTProxy

    AzureADConnectAgentUpdater

    "SQLServer Reporting Services (MSSQLSERVER)"

    mysqld

    ds_monitor

    sql

    ofcservice

    "Sophos Clean Service"

    mfewc

    LTService

    "Amsp"

    "TeamViewer"

    BackupExecAgentAccelerator

    mepocs

    VeeamNFSSvc

    "Sophos Safestore Service"

    MsDtsServer120

    svcGenericHost

    MsDtsServer110

    AUService

    backup

    SQLTELEMETRY

    AzureADConnectHealthSyncInsights

    MsDtsServer130

    ReportServer

    Altaro.HyperV.WAN.RemoteService.exe

    ProtectedStorage

    SSISTELEMETRY130

    VeeamTransportSvc

    Altaro.Agent.exe

    MSSQLSERVER

    sqlservr

    KaseyaAgent

    "SQLServer Integration Services 12.0"

    ntrtscan

    "StorageCraft Raw Agent"

    TmCCSF

    sophos

    ds_agent

    MSSQLServerADHelper100

    VeeamHvIntegrationSvc

    "Sage 100c Advanced 2017 (9917)"

    "SntpService"

    McAfeeFramework

    "StorageCraft ImageReady"

    VSS

    KaseyaAgentEndpoint

    HuntressUpdater

    VeeamDeploySvc

    "Sophos AutoUpdate Service"

    "Sophos MCS Agent"

    KAVFS

    SQLWriter

    MSSQLFDLauncher$TESTBACKUP02DEV

    svc$

    MSSQL$MSGPMR

    psqlWGE

    Altaro.DedupService.exe

    "Sophos Health Service"

    SQLEXPRESSADV

    "ProtectedStorage"

    kavfsscs

    sophossps

    "ds_monitor"

    TeamViewer

    ThreadLocker

    MSSQLServerOLAPService

    Altaro.OffsiteServer.UI.Service.exe

    MSSQLLaunchpad$SQLEXPRESS

    Code42Service

    Altaro.UI.Service.exe

    "Sophos File Scanner Service"

    macmnsvc

    "ds_notifier"

    ViprePPLSvc

    AltiFTPUploader

    "Sophos Endpoint Defense Service"

    VipreAAPSvc

    DsSvc

    "Sophos Device Control Service"

    "StorageCraft Shadow Copy Provider"

Extracted

Path

C:\5f2tk2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5f2tk2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/96EC8990C36043C3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/96EC8990C36043C3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: g+Q5pGCUvbPegYHcn7yKFA5FIa2pwA7f4anoWcPP+T1LIVrG14J+wlminwkXD4RF 0W2JtsrxJV4XMu/qvEqoe5x0LofZVzkrhCsA5pCRg+VvNxerf9loKL/kbLNIDxKf cHm+3LiJ3uSgTyc+CUpNRswIC5Ml4ax6OVcxb+626nHRy6BANMlido9752mA9pkS o1s0hAw12RdBGfxq60nYcCvy8hhyNWePav4ixWeCH53EmvH92MkH2zKmlUMLj6fH 8m0CvpLQu+Wci6awzEZvw4oGgBtq/FJyulgiThZNYnlD0IUWjf7SmYyPMdO5/nzs Ym9isKKaQogW9dNRWq+T6HKbLszuwtR8mlbNf01q0w4ImA1K1yY1bH+1K7dKKkfw iL5VxYjnrMcQt6ZQl7ss/rPNZhNofy9wG2FTBp/tawNfYNAYzx6O9O3OTjps3Vab GzfE8IR6Os6hj9us9cvxbpf8qiBjkU0qHevSe9Z3TJtODOKpmDNoQ0Ac9pHHCveC lUafmI9Y2S4Hb/72sV7JVAPiJyhhtTL1btB/m+mW8lJj1gNBHJjIdGREMlxbedNl 7DgwyvP5lAlldrFgP+vsiZkdcnF3yNyzg5Ji4f0gwqMNnq45RJkiCO/RP5OeG21o q+5akj0ol6gsTaSAm67S4nQDsMIAC5DL1iabX3UOpdZiStVG3WY13CvlCuUGEuFH mU3xa32lASfut9aWJsFImEv3AHDCJLBsHgbrej0ZkjGIHmC/b+K6Jv/D3v3Ssx/i LOXVaQ0GMwq6tU16cqcPbdG3mCt+9qeiP9QLonMbtkSjnLaSEepe7QIE/DIfDsT6 KH44b5D7lq2n3PiMBJnAes/3y1DhiIGYI2VdgYDCJ3JuukexYCnk4rSA7R23l+53 gKsWpazv8j3S+5suHjWyy8z1apaUEwLmuTTm9U0nwWE1GgutrS100rBCHn4ZBQo7 9I0v+T27hvM3YSV4/eixIb3/5iUIoL+lkNqfuawlc8xNaDkdXWrSw/vmeA2uZsYQ 55tDRzuxrKIOZ02NFbNITUyGsXFsixzWaDnAiql7VF48sEPPksj+JLJG/ePRhBLi MeJ0TZN42RU+6JmyATH/xovlYSt1WI5SzVR2m/5xmhT7PYg6zQUsldQBIH8GQiBT Nbph+O1tdJqzv5LZe8aMc91BMevXc/7XTvbBrODrSa67EeRJyKvWnuoIFhBNNpx2 emYsU1DA15cVh5a3gB74Cpcety0MIkY2yZkz9WowUwJyPV0K0amd9kA6WYGVn+lA BDSqeGZp ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/96EC8990C36043C3

http://decoder.re/96EC8990C36043C3

Targets

    • Target

      939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d.bin.sample

    • Size

      120KB

    • MD5

      9a24b3de7af3b2a2f1917e72e64da268

    • SHA1

      783bebb04eda5a88851aa741133ae49c29f44415

    • SHA256

      939f58c10211a768f664a8f54310dcc42eb672887be61d5d377b5a88be107b9d

    • SHA512

      631b8165326463749e8bb01e74304343158b4cd4c6c4e4a8e60922a298b90dab9c83c60fd69c4eda8ddf2dcf97c4040dc723f7e9beeb9a94aee568c30867044d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks