General

  • Target

    f6d54e270dc832c3add99863ef29ae222104f1d3a770b9fc72d41f27283a8a52

  • Size

    199KB

  • Sample

    220124-a2ghnsghe2

  • MD5

    4b3c64cc49b11fdbbf66e79d03deb5bb

  • SHA1

    c7b50173c65f85bd6a5963bc3c88783d9f6dcfd9

  • SHA256

    f6d54e270dc832c3add99863ef29ae222104f1d3a770b9fc72d41f27283a8a52

  • SHA512

    4b933005603cf2732247aa3802fc1f3fc7eab605d540371aef8422a230b39e2caee01ca3fb621d33e57514301b52e3765d36c0359fa9e5d7b01eadc8a30d439c

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

Campaign

1428

C2

firstpaymentservices.com

krcove-zily.eu

softsproductkey.com

naturavetal.hr

corelifenutrition.com

leda-ukraine.com.ua

beaconhealthsystem.org

acomprarseguidores.com

extraordinaryoutdoors.com

mardenherefordshire-pc.gov.uk

stopilhan.com

triggi.de

anteniti.com

aunexis.ch

boosthybrid.com.au

bee4win.com

gadgetedges.com

tandartspraktijkheesch.nl

8449nohate.org

simoneblum.de

Attributes
  • net

    true

  • pid

    $2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

  • prc

    excel

    mydesktopservice

    sqlwriter

    ocomm

    powerpnt

    oracle

    mydesktopqos

    ocautoupds

    ocssd

    encsvc

    mysqld_opt

    msaccess

    visio

    agntsvc

    winword

    sqlservr

    tbirdconfig

    wordpad

    xfssvccon

    msftesql

    firefoxconfig

    dbsnmp

    onenote

    thunderbird

    outlook

    isqlplussvc

    dbeng50

    mspub

    thebat64

    sqbcoreservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    vss

    mepocs

    veeam

    svc$

    backup

    sophos

    memtas

    sql

Extracted

Path

C:\vapq9840g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion vapq9840g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9D5F6E4756C2C0FC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9D5F6E4756C2C0FC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: v1b1f79ZPj9mQqgsNZC8O5GbdILbqwy4XZNJSIdYcJ035uTF3lnwYH7BcTsFk9Jo uIQlZy+oA9Scw0K0zLsBQGpQx3nebYlmdQVfzAqP7H2O+bvQxeFPn0N35K7BJwG1 ENNr7Wn2gir6E0ea1latgz9z3FkgUly8soFcNtV75iyudR74drC9O81QYyenFc1Z e+0eCohtT+5BtwKGkCiOWwswvpcOVp0Vcf7hB4Iyn9yrbPn4KfCdqVpbgTMvRcOX Uxtua3+jRU1rFCX6Rlx7To7oWIm2p8aA3iDKSX6tI8X/VMQNbo0M881L1zYTJPXI LJM0GruwV0kTERXEPZULOmBVWC5MPbI4hZlDK0x9JIBe4rNxSb1f+dGoXsea4fpG SyYLcNuBqH8pFa1UX2TQg7bG+TzXVIXjjprQbO+phg/2aZhB6W4lMD0gWQiDR0DX H5k8yZk5ti7w5MB4MYNkYwxv8iFVI/n1tM9Hp9SLIRjz3CI63jLiKa6P9zR4sQoZ W5M2NM/pwC5yJsHXhQygJGYsmhRX5iQgLfAq/hMS7vyRfC6h85IeP272mHko+F5V pPVYsZ/mqjk3XUaqFSb8fqQkU/Iw5BY2iob5q2cmUoDrUZyLNhFOQ65MCp25Dno8 r7CSz75AJxpNx/wr7dryi+HuIjY+qnp+1IIAMJzyTdxzNQC7wAiyELt7yRkSyJtw qXd4NZQrf4jCbihWljHzlEMXTEtf6/p7U3JUciWrMQjJojSFhJ23UgMFKbPd06jI e9gfb7K99xDqAWScGqih1OD57v6O8KoZd8V7KTuZi8NuqsGmcFkTRIwsDHm6apiS G/86XyuRbOZi2IzzWSaOQtTrqEiZOYaG/X82/QgiWnUiauxUcPCoTPsPP90PUMwZ DfQoFpgjxj6OWvisfz2OPoY4OD7WD+jQ2wPna8j9D8LEEByNdlFJmGxhTyzL72pB 6mPtkOc5V4hLSC/3otopHOiHMfyauicG7B2dMNH8k9fP21ZAC5EwGlSHnbinjCwM cHRDh68bwkVnEP+z7x8f6nhOu/ugzcky85I3Tcp8UjQpxAMP3sWsYWo/KThJBkzD llY3zN7obTKWjPuJBhfSddyy/FiFDU2jzGJDH+2/VsCjSIkKznFM74FWaCslkFXg dLwtCCR3j76pAeHFbSlvklzEAAOenPor6ZHMBr762TBhSrq7p8tJp1UsUjQjzZpA lFHQG6g6ppNuG1eyha3CW+k4PWccvHEIFiS1Ne8yaQMy7EAFY2007q1tQES8Ovnw G5Mj0HlW4pVKPWGo4dFh/xPJ2ZK0RAO+/aif+yZ3 Extension name: vapq9840g ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9D5F6E4756C2C0FC

http://decryptor.cc/9D5F6E4756C2C0FC

Extracted

Path

C:\3815k-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 3815k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/087F90BF20A6BE97 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/087F90BF20A6BE97 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 76vWEQg0yIJZP4mLC9WbeL/lu5uJY0Od5Z125mUlmaN7aznjqIxsdGnKCntD8Y9x XFGvj1vntIltvZoK4rjSwI8dOysMgly9dNemhOEVPN5i8wdKW82SbygLyzTlEQ9l gXlFO1e7m6PKceQvLHQCOKyZeFkdymV8JA/sjQP+OzMGgNQQWMkbBpQMJvLlMkHm hBvkIt+QD9TnMTEW/7uDqC0YD2kl4y17VvCjOPo0m8v5T7+JusN1Rtr5ln1EoYSz UE2Cu2n4oi4Ls/EI1zzePdfXxLhUVJwhHAI/YiroKL/FbLsplrVVHUZWRLxhEAXR lXQBqSqXKiMDNa9dtKautXwj571dlLoxmmA+je6C+hiPzmABw+ql5djLU6p49P1M 7J/6gHOtKS4sJX2FyVNmlR9ARGcvIYoWqyDHKodFKSbw5Tx6c0HBOpaXtG85qIkN BAufRcZJ8swpU5+d7XyiA2EoBX+D23hQJ4GRDTgzD3qVZiUgX12ywD+dPJ3A5kt2 whY395xi9YRTJ0vE5c5+h56X3IdmzE6qEwsTaOMDNf1C5Ts+kUUygDPA3+A+Go1Q OmecoFeTpJwPlHbJAjtFpU8H9hEoP29rnZ4OVQH16Ys7HrK9S/89eJA+ciIGuGmJ 1H/HaZwATOM7JCuGLGF5M8XOck2mufr/o6HGKMRLR+HG+22FiR6qcc1jrUM8T7ka Q9j2TB3jNXltSVqAZTqAPgNLxkCLYceNnrz8Do7ZK1sIvCo5LmLFBOiCYgmh5Z1G zYRT8CywauoLWnqrJ9rVbL1/QWjbwT0YJ4J/Vegwanub6stx/Z+0MiEhwoAYHhhc eTqLlfTQm7bj+Al/GNd4Buq9xOcFh/coIHay7TDJvoxqk1grvIpqigfQ+knTqjov 4Np+cbsYxwgRbg3hxvzmLV2XODkEK0uABzAS9fPshWgYi7qZtPQ5+fRgHk79F1ei R9aokJU+nlSLLe+slIbn6IlUdO4lODwQNuzBHD2ZPCxSCd0iLh1ipZQdOyU/EuCw P+thLj+fUel9a+v/eq6uS1HDNq3NSNiBrkldz1f1hNWUuIfzhfoY16sTyO2GV5rC YYWUH8vkAI0iV4nlzb5rIagny2CpUMcAS/PLZrgxh2vowXitu0Fl8n42jxahOyCq mnXgeo20wpXF/d+Ic0LftKQ8Sr5gbR5dS9/pFvpcoX5kMPdohjwdwKcjZ2KAYQfn LHvNzERHjpoxoPkJwGie0XW4YFq7HKF/trhLZLY/9MXyeQO/Guz2HcJef+6expzD AaJ5/KEEF4zAP7Gw714= Extension name: 3815k ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/087F90BF20A6BE97

http://decryptor.cc/087F90BF20A6BE97

Targets

    • Target

      f6d54e270dc832c3add99863ef29ae222104f1d3a770b9fc72d41f27283a8a52

    • Size

      199KB

    • MD5

      4b3c64cc49b11fdbbf66e79d03deb5bb

    • SHA1

      c7b50173c65f85bd6a5963bc3c88783d9f6dcfd9

    • SHA256

      f6d54e270dc832c3add99863ef29ae222104f1d3a770b9fc72d41f27283a8a52

    • SHA512

      4b933005603cf2732247aa3802fc1f3fc7eab605d540371aef8422a230b39e2caee01ca3fb621d33e57514301b52e3765d36c0359fa9e5d7b01eadc8a30d439c

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks