General

  • Target

    e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606

  • Size

    118KB

  • Sample

    220124-a57h9sghfq

  • MD5

    4e142923b149ab179984940e1bfb6041

  • SHA1

    f20a1803e38b4d7b9437d53a95403fb0b6387f11

  • SHA256

    e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606

  • SHA512

    6f6ece3f0152811348e44630a3139f2f6ed46fc43de97cceaabe35616abdb2c4e84ddd2e4b2c6350a78a49b8323910d09dc342c5836a2d882e23f76f2aee6fa2

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$4vqFqndDqZ9L8CG5VdfbIuQEukTE0dpZpo8XiACJmtLfLjFX.FFJS

Campaign

6862

C2

poultrypartners.nl

4net.guru

videomarketing.pro

happyeasterimages.org

licor43.de

milanonotai.it

smart-light.co.uk

manutouchmassage.com

leda-ukraine.com.ua

danielblum.info

mikeramirezcpa.com

blewback.com

schoolofpassivewealth.com

dnepr-beskid.com.ua

tips.technology

bptdmaluku.com

fatfreezingmachines.com

zflas.com

smartypractice.com

effortlesspromo.com

Attributes
  • net

    false

  • pid

    $2a$10$4vqFqndDqZ9L8CG5VdfbIuQEukTE0dpZpo8XiACJmtLfLjFX.FFJS

  • prc

    msaccess

    visio

    ocautoupds

    onenote

    powerpnt

    dbsnmp

    thunderbird

    ocssd

    ocomm

    sqbcoreservice

    wordpad

    oracle

    encsvc

    excel

    xfssvccon

    dbeng50

    steam

    synctime

    sql

    mydesktopqos

    thebat

    infopath

    mspub

    firefox

    isqlplussvc

    mydesktopservice

    outlook

    agntsvc

    winword

    tbirdconfig

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6862

  • svc

    backup

    sophos

    veeam

    svc$

    memtas

    sql

    vss

    mepocs

Extracted

Path

C:\e5488n840d-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension e5488n840d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D2FE04015D326B1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/5D2FE04015D326B1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dUomdYIpLLvt9rHhVD2IDdcxpVTxbjXsRfALplQ1FiR+3IJS4X1xTgyT+j9QWQAr FXds5Dbe4ymJmRvPPrxUof+b2fKUtqRlY0cXbb0DgQQnglrQMIHTJ/qsenejF41B 2k3sGuAHxe5VsnCR6IGWILC9nn8mqSdn1doBtDiZsnQZKAKmuLHKx+9Fm/YwtvXa ncS24iffupbn1vJG7yXJa04jq2FuUap6RvmBZI+NC9KQ0zUXho0SXVPcCZ2QvcDG sGMhvrq18gGj6hzz22uXm07NoBhra9YBxIubY+AWVnsByMTon88s30fgnWs2x47w qt5kRQQ/O8teXluHd7CeM6FEValiErOdGQuo4ZvVkjonssbjkAvZgg27iTl15AtV s4VVsHz6D8opFm3DI6yNMgBQHUdYOIY8MBjhpDk+K01YYJkva2BlmRJUSHf3lozV QTKcHCcyx5zj6rCiV0RdHm8Syi1SMgoUkofhQJhp0ce5Yi4ab8AmO4V2B5+rkENP BJSBKNQtgaYsuG0T6tX7xx0nD7W8l0ic144CoF+o5RwjFbVsXVJr0G2Cw5VeqWH0 S9kc/aCKIH5IVXRyr6L6PaiSjjZJle+GyK87MyYNsbvzdagrGRuc3vWAom7FPdd4 IffWDNYvFel8N2vIFgrDwT6ffJfxymZuUAdZfDlo73pJ0Yo7Iv9CKHWNw/Ks3CHZ 3+ZFnsmDTPU5yOucAFZkOf6bv7gKPMqtGPOpGkupTpObqM9splE9nvSXmIrd3Hk+ sbmNIvQ4073dkiTU/7x0rKjCugaXnFAACJLj9w9pIVq3Kv4hDj2VZxqHQ5/BZmDL a8/KF7rwBdqIlpKpwJEjAiBfEkflNaW8B7R2YXJpbeKjYbuI3MQdORogutYCN7LU LzwYPNGtC30l/ZtGsdE9WkH/uv2vRneK8Q7A6PmR3t/lOP4ROmGO/jqY3/8BkyhB v0Dft35667cn/TxOEFblWzfGNQB+6Hh/ACTmo6bTGiSSUgJoeojPUBIOA0IhvKFG SJp4R1i571fBXOwLY/rnuSPytxHAlAF20vn7sO4glR1EVF/YNhYDkW1yWQrbdej6 KP+ABersufdiVwpj6ZX6MWZJi94MPuCgj0MXNNEpKJZfKAdXktbbPKgE9vex7skk dD6kq8vcBHlNDclkZIKxhdfZ8gO5HM7IbzAxW9dNunvz8ToWf9WBWvEjq4IafJpf SlD0sMx5BUAuY3xeLvDBcdBqp9t/8MQ5h3RJmx0CM46WdBaaPQvBPtrd3qDae179 9oWLO2jBUd7aFX5YxryqB970bymHeVcqA35TZdLp1q4= =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D2FE04015D326B1

http://decoder.re/5D2FE04015D326B1

Extracted

Path

C:\i0uddnw1w7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension i0uddnw1w7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/657C035421994DBD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/657C035421994DBD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ISEf6uJVw7MGo1za7m+E9gV34HCHl9RsrGnNoGIt6Tpe6j1G3S5eJMntRSYsMh5I JqeTUk4fk8AleIfT/J4uvFYuLC3d6tGpjOLEjKR4AXkYHSTCTqnsYVxhC+jMZwE3 4HUNU51nlxugaW+Oyv2vGdGNiI8bBggutKPqfu5/bDfmg5d86InMKK8uH+pVQvGF D1iwOgdFTSZ5RzkQa77zttLjU0PPK7SgQWLi1oRA2fzsjNZtOq8Lu9Sk3Rj8jAZH unO3Gfymv/cLde5X6yBuhGwzhP+t6Zi9743PPgVczQy3PcbcK3ySmXxooBXrsGLj TyAplbJwdOcIq9HFxjR14qFwyjErQgAJBhQhaMfpNBPX54aUwlE/ssEaXk48IqFJ p28uLCwoa4tlsh3tIzOmJ7kZKY8xC/vlqpsCEHUSyCllZUcBO7yFqdAawJ8hZ8+7 pZmDw6aYKXgIeC7YXNSl+UrjrOamv00Mya7gBUapDThi//3S9ingLTIexG7RGbMF DrhoIEgJy1OvhsZsHtNR1lyLRyYsXqsi+yB9J/RdWxGe2PO2Nu0QFNo32XKwmcpX XEyJpemA2u6Qn1wK9PqCIUP6yPboP21KHW5VOAbxPy5pIn4s1/J7PrMJzZvhigXI frLzX/E+HyfyMqV8XwNiM2LQnyyy/W2uHOo4T6MkX9m/Eq96SKsEfDhDFtgrqtse q2q7uBYWWCJtYuAUKVg4bdHq1m2aHsunhGS971N21q4/aIcV/BWxyg9+hYegQfpM NCSLrOgzRfWtNQrWcOfDApuSYipCRttLWk/SwJdJFMpjB2UiUoH4hb1s8NSJ0npl 7gXtlrEfXuyXjw7aEDFL/wE3xm704ywA3MWj1H6BHBXQtrjJCCTFtvlbyTHSPuqK FZNmdycWLFy2onjlTqR0PStu2r7dGzdlEXT8OUjNg1aSPx1Sn7CPq9wyUc3pY82x aGV5mHRHMHNaaeGLPWXy/msE2ZmbEHZZIxFPLp3/sOzSWdBNIdxiZHbROPDZhrOI DYQjbrjzuByvcRRbWgXyutaR09KS57Nh/OVv6+UC9uUqTvEnMFe1oE7Xj4Al6GH1 pZXjZ0ywgXnqdGCuzhoS9oRkRmn8zOWzj4Lmg/nmmpN0EPCMJ2Ox96DaDFxALxA2 qwDAI6C8Fih8Nk+ddWyEiUyWf0EnsRIE1paZaEuaPBb2mSim3Oq9eyw8u1NXkbP5 Z/kRJWSXnPSNAU2zepijFNXPWFgNoTVOaIP/d9CRYERckiYbDV1muf/ta/yTu2fc p4ELcxCzXngRXZ8HR4emgabznQMKzXW9 =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/657C035421994DBD

http://decoder.re/657C035421994DBD

Targets

    • Target

      e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606

    • Size

      118KB

    • MD5

      4e142923b149ab179984940e1bfb6041

    • SHA1

      f20a1803e38b4d7b9437d53a95403fb0b6387f11

    • SHA256

      e5bbe16980677d0336ae0e6830ac887bf072c70caa6d9536ba146e0809bfa606

    • SHA512

      6f6ece3f0152811348e44630a3139f2f6ed46fc43de97cceaabe35616abdb2c4e84ddd2e4b2c6350a78a49b8323910d09dc342c5836a2d882e23f76f2aee6fa2

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks