General

  • Target

    f2804c038d9bc7bca3f6da8ba3d3ee21bba77e8e3f3440e29cf5029d915d1560

  • Size

    144KB

  • Sample

    220124-a295zsghf5

  • MD5

    95db06861d6a212eb39d24b5bae0765d

  • SHA1

    e08af39caee15babd3a6afa061103a0d9cc53f98

  • SHA256

    f2804c038d9bc7bca3f6da8ba3d3ee21bba77e8e3f3440e29cf5029d915d1560

  • SHA512

    0bf163c1b602ec888f24f596d40651428b30ac631c2ffd2098a87751877e48f651a0658d73e4b388fb7c60aa08dacef4db2d2ce5f7fe2c98b8317980bfc542a5

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

Campaign

1428

C2

ecpmedia.vn

triactis.com

promalaga.es

siliconbeach-realestate.com

bigbaguettes.eu

web.ion.ag

spacecitysisters.org

abogadosaccidentetraficosevilla.es

blacksirius.de

sipstroysochi.ru

foryourhealth.live

schraven.de

mardenherefordshire-pc.gov.uk

pubweb.carnet.hr

joyeriaorindia.com

makeflowers.ru

seevilla-dr-sturm.at

podsosnami.ru

stupbratt.no

jsfg.com

Attributes
  • net

    true

  • pid

    $2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

  • prc

    sqlservr

    excel

    sqbcoreservice

    powerpnt

    mydesktopservice

    dbsnmp

    msftesql

    steam

    sqlbrowser

    ocautoupds

    visio

    sqlagent

    thebat64

    outlook

    dbeng50

    mydesktopqos

    onenote

    sqlwriter

    tbirdconfig

    agntsvc

    infopath

    encsvc

    oracle

    synctime

    mysqld_nt

    thebat

    xfssvccon

    isqlplussvc

    wordpad

    mspub

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    memtas

    veeam

    sophos

    vss

    svc$

    sql

    mepocs

    backup

Extracted

Path

C:\262933o09-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 262933o09. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B830E1B0B730D102 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B830E1B0B730D102 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: nGUPFP0P10UkAiCpUKysSGnkhgKRkMQwHOHg1zu0m2MWAt8q8y3rGdT96JgNIkMd Tvmz58iEafhavSnBJdW1TB/mlgnSwFDP4XLGYzSkX132tQ/rnSD45599RO1NxRyd /1luWYRPCq30vP65MTk3l7rFlgrzyOjjVm09tv9OnMFP+zehkNo2125Wr2Y4OPnm SZeyRVVwtuhkRNKeKuxPV63bYBSsSekCXS4vZ+1WrZlBnwS5fuRceo+Pzy3V1hH4 57uhiXS2hSQyJyPr9cvu8AVkyKuzlBijYyIPaCSplZknNN0sd3FwGubo5Ua5Befp IMkjEsZisGWpuXlAu6D96ySrW7D9yD1Mvtj/56T319NQUHAmz0z90O+jrRnM4Ix3 tV8Ji4GfLgwL0Osmas83ByZsCWPIDJd2ZWdDc7EX+i7uL/lZM9pPJjgLzcf+OwDU qc353iILxJ28AgYXHW91G7y9IbRCC18PblwrQDQ+jN0i1kYwbtj0hi9NChJOTNwd 02pd9qwVY39+W/PTzhjfdc0ZomUNn6lO7TnX6q+FEkV7ln0DZGdLHWfSTKbo1LFR nql8QlGCuINYdSWAjoH3LwKbycCIIhXErBuRVaDPZWoxFWxsG+7OTHvxmC2Jy+rW rjXZ8T0dmsvpXQeqJ2nCk6JNHtQ6A3hTgkiuXz/HHZa+xAfTRmox9piUIbT76NdL tXPtfWZWi+fc8LskXzgBs/b+2m8kKWFEVQl2UWAK/d7tzkJDR1ngOq+vCPSVdsZH g5uVN7dF0n4O/cazivF3RxPQTZk3vKaNrbRccMidH1M/4Y5vfN7skQ1cHXpTuwwO HpMwYY0LY7N9NuxBuOJOHCJQjjadz+LxLEg+lW9EERDHd5fY+A881U4dvmOElpCi MGjvufy7yrtGNP47U+Rqs8ak1Rl12sAj7VPhwzKzO5CkyDblSWdb3BqWC+w7uw9B +vDwpBRBIsHMpLRl++Ek4EFK+21/scYE8sANm/zaX0bfTqbQBMSu4J95rOUfEWcW +tyd+5w/9bBVBM/H8UqE1vlmNxhPoRdcfyA40TE9iCTf2P1WApZKNaii80NwSr26 jgqPIhFB6R8joG7kGhCZINdl0jkM4NfkVQvajD1JfiMs1uQsC+Avf2OAsY5QhuLv vhusJfjw743iPSVJTJAbol5BWnD+4QusK6OV/fsbmzjE8ZvclK+9rb7Qa6/do6Sa R1MnNrbPP2IjQY2Pb3JykCw1+gDImMFpqTHF3mjjS8stNYcEgsKdamwomOH0B39D wWE62jAb9hakbgaLzdSzjirg1b39StEpErrvDQyp Extension name: 262933o09 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B830E1B0B730D102

http://decryptor.cc/B830E1B0B730D102

Extracted

Path

C:\a8s9y1o-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion a8s9y1o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CB3EE8C1B04AB7B3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CB3EE8C1B04AB7B3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: z3FD4xjeGp7RX4EeSPemwEyj4jDX1+2I3a/Hbt0h4rbxngKCXUbzhpu/XTVdAYWA +9L7TvKq8BxEVpgEnP8MKdjy1A2Dcch5ow29FH5VS1rpSNdd+IWLO+uAvI8r1c56 FQPJXat+k345NMp2JEnCr+0kLOEuQ0T38CwG7wNF9ffAmOU7WIdlUhNL5CLDgutb pxqpoajD2ZgxWS+3M6+CTbTZUn2bLwp8vJmz8lgAtAkRkX9OPPias4AM9uPRm/2f 9i003L2tOpluxo1gBSicajAOKZK9OSZRZPrJVo2F424HOvieFZ/JWEERywpA4HVp JPe8rXO9bg0knAEldgsGd+4thbCaQ5FbnQCpH7bfn5+oksfGAJGn2WuD/m4y953W YigK/a1doFSX8hdNjHT8qmsfIj8GIjO9yv33B8BEpgIJyQf7l4crPItRhRaCQ6Z9 4RLuCBuVCLv8VcGCdjB/VQsdNtdxhRqe85CpYcfMk2iKvBWf3YF1p7UzcWpEnZwH NGgW6PZczG+DXb1qYv8gjQ9pIrPbLuHX7puiyMr3xn3qxzEAAekmnv8MFr3EHg3s x0pPxvrpmZofSglbFM2k8xKtW89S5Plm67TSbVAs/yaVXBEodqP/dEQ+/E9ESJv8 oFaOTwIt/ySglvC4nlweU01VeNcrrC+CKgFpufkkWJ+sG0NYLtbH/HFQ1SWTVZvz vo+6+doPB11TvoHaloKosndAjS22ACW2cnplPMbXGFdYoRZsi3aJE0pHEqIBti5Y uCpzBqtjmXiy68+tReGA2eAAmWxX9x+DHoK9Hj5YPJABNtBEMTtwvXkrjJwF9wJh hJHqQANYrWvHvHGrwAKkAnRTvHvowgxfU5wgegtFly60O7o9JUxbO/XaUoJPW0bL FYOGhTWP8LWHXrUu3PatVgZiscgL9Iq8qVepCho4NaQHBG3QEGy8LDpKSNYwblGD RJ3z9WDWSA0JYOd/Q4FLYft6s3aV3hgi3TNs/gu04J4LIX/fmhZfQNZeLRkUmgPE eRuYsawsZCSTdaobKhgbWq/n66DFZVOj604M7kpGc+vzKh8LGVjndUKGQzx4/qDB aWwBkNckEGhFlN/1ej93oKHzCMTjWoKU1yrXQ6SvX1fFfRv2fZ3K33p2x+z5kZbx KD7OR3wDHYBLq40ge/WPs6tRpcIaaIlgwlqA9+HuWdtirCZarSM1YPIF/jK5wNqm cGvtlwuA4zg08LqdWrbVdehFgltwnxOPiG/Bm9cdM1UVxxKSg+QxawV8q5Z7FSE+ 2t/qpS1g4QO+jDKWsGbQgLp3 Extension name: a8s9y1o ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CB3EE8C1B04AB7B3

http://decryptor.cc/CB3EE8C1B04AB7B3

Targets

    • Target

      f2804c038d9bc7bca3f6da8ba3d3ee21bba77e8e3f3440e29cf5029d915d1560

    • Size

      144KB

    • MD5

      95db06861d6a212eb39d24b5bae0765d

    • SHA1

      e08af39caee15babd3a6afa061103a0d9cc53f98

    • SHA256

      f2804c038d9bc7bca3f6da8ba3d3ee21bba77e8e3f3440e29cf5029d915d1560

    • SHA512

      0bf163c1b602ec888f24f596d40651428b30ac631c2ffd2098a87751877e48f651a0658d73e4b388fb7c60aa08dacef4db2d2ce5f7fe2c98b8317980bfc542a5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks