General

  • Target

    e7ddb20095cd733efc10fba3ff1a8b3e83767cc900b5a976d4029456226612b0

  • Size

    158KB

  • Sample

    220124-a5kphaghfj

  • MD5

    37c62627383200afa90abf92bf5c4f72

  • SHA1

    ba0cce7a0b27b4d6c29abeb6d02f5bc54c6c8cd9

  • SHA256

    e7ddb20095cd733efc10fba3ff1a8b3e83767cc900b5a976d4029456226612b0

  • SHA512

    9eb9aade0df35394f2b326d630dd24899edd388c7f19f7da81b99b347ab402994f0ed4540c9a8bf58f2e1abada2632e98b714e615e25d71ee5892d2cbff16fca

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

96

C2

vitormmcosta.com

allinonecampaign.com

edvestors.org

haard-totaal.nl

stabilisateur.fr

anleggsregisteret.no

ufovidmag.com

oraweb.net

oththukaruva.com

acumenconsultingcompany.com

xn--billigafrgpatroner-stb.se

glennverschueren.be

subquercy.fr

leadforensics.com

devplus.be

silkeight.com

bluetenreich-brilon.de

askstaffing.com

hutchstyle.co.uk

netadultere.fr

Attributes
  • net

    true

  • pid

    19

  • prc

    firefoxconfig.exe

    mysqld_opt.exe

    thebat64.exe

    powerpnt.exe

    tbirdconfig.exe

    msftesql.exe

    mysqld.exe

    sqlwriter.exe

    infopath.exe

    winword.exe

    sqlbrowser.exe

    sqlagent.exe

    sqbcoreservice.exe

    mspub.exe

    onenote.exe

    thebat.exe

    visio.exe

    mysqld_nt.exe

    excel.exe

    thunderbird.exe

    encsvc.exe

    mydesktopservice.exe

    ocssd.exe

    steam.exe

    ocomm.exe

    isqlplussvc.exe

    dbsnmp.exe

    synctime.exe

    agntsvc.exe

    mydesktopqos.exe

    ocautoupds.exe

    wordpad.exe

    dbeng50.exe

    outlook.exe

    xfssvccon.exe

    oracle.exe

    sqlservr.exe

    msaccess.exe

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    96

Extracted

Path

C:\38oy88-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 38oy88. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/286D3BBE994DC093 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/286D3BBE994DC093 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: xdeH8bz/SUsfui+8s9pxwU4NTJBIb+utG+rYAMsH4srxV5RoosdOFpyhDcY1DRoU 7FxQ4f2Xf5qxBXnJFH79dEDpNo0IGVugigce0zU13tGbLxYtummajtwreua5DDeF fSZazMsKEUIKH6WnzEB+t4wsqA6YW9oQTqq85qdE8o8KgiPLvUkZnv+LIwJDZhB2 OAHDAHo6vInhqoObvWnUuXqQj3DNRIQJo4Ms7RTPF2p0MGgkB9ukxWYMWD3ux6C/ 75gU36ZlKtvm7xWmF/O39+w7BZ9G2dicyhuhwB8cl6WiWXQ8wQvtmLJ/TVErdv8e cahndO8xIp6Tcv7u6rOFhb5EnhNs5AOm5rhRFuGh+0A41QRjUjKxddbKKc++Uo+Q T4Va2PdK1zriLSpDjQllS52qd8Nlglvf3CUdvdPOHi7TxtBVrE92jiqZ+eg8OfCL yejoaWEJyucsHydaBtktI0VFhG+s6U37RZHzojhv+ao4wX/GPGxkodIEX7IFRTSw maN63S3+NiDEhBGJfEQhn7ZzvZuIUAqksJm4VbuKgJkDn01YZTJ3A/86ZOdA8b1C Paoen5FdsHB2NuNf2/B0xyIFUpU+GPeKOqUaXrX0YcwVwMLhr0i5V1T8OscM3zm8 hMuRxgvACF1obGSWN9CPBW0wMb5i1jNJKVnfhFbgVOnbBRDYd/zO1FnEkEoOeIIp xoA7fBbu20CGdsN04uml0xHqpK8S5SmQWO7LFf2h09fy5v2vZHCQzRVs8yqU24vU jkJN73tJ3Wej3ud2YBP70E4OlWrbho6/43+1oJIq82APd4/JSdguxchHgmJaGEt+ 9UvvE7imEkKdd6osTMyw6ES4NJfT9nKB//A1UAB075MkA3oa0/YXcs75k5UMon8W OpBtGuFEHPuRK9YC+g9PTdA6oHPd0e+1jTlCOH1WIeXdUan1JB5Nf4Le7nnrX/cX 4w/C4DnTBmuFi9htfW0kIkTwhZb5TWFr/HuNkVomI+pgu9E4GsEQED+yM+6VOUST IGlTqwxgK3pHLAMJOqQ0V9bWGFiknVkQ9ptYsULjy2QXn6Yj3qErxgo8CxlJYDVs RUu0JUO/fysu8/9UERQfIb6D Extension name: 38oy88 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/286D3BBE994DC093

http://decryptor.top/286D3BBE994DC093

Extracted

Path

C:\g84854-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion g84854. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7EEF930332CB2D68 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7EEF930332CB2D68 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2kEzfrIq1WZYq8KXVmsq4zYfdsiA5AF9MYd3IrzB0HwBWU2s1ZfCIhzCj7YH7T76 uK1y+9UeTgBrALeQEMfFslbRQCpwmz6pCLWJPAWOQoMUtVAYnVGoAiDZXL0x1Mld jDKZrpqY1iKOWqq/1/7ZrNUNpOlITcz+ip1e3hvUkoj1gozCTd/bwILDgQez+cBP d5lkfjG9jS1W1pL9nkw5Lwko3P/pm6+eAsuo7s/5bGto6Bi/lMCqNOvQeYdyWo/k x9R6OHqT9m8PS3PSPE3YRs3UXDIslDeiSC96vrqOMkrbhqv8UYWbKM8OEHsNslax kojPvC7ESsWPV9kCLILs+jf/6aHok0zOw6iik2vfOOVxcEoW6SxFj5v3xQxtCZX4 IrrcHzzZRZxnfxn0OyKwfPGP3lp54LytaWp6KNXg3DjI/dQ9AYFg7f7XC9MINARB cqog15dNSgj37kZNzpxpVXW7GfyALHspTCgKXEZXkpKVnYDhJw+Cjr0QBynWMcED B0D9HEFdq6MUaABP7c9AmgL5YbSkwr8jDQPk5l+TYwsvXG9O+j9IbM2PpJvmsxqs jTEXsf2isMutopE14IQzQWbYryNZbnY0S7C92gjuYEwiS4k1ErWydCCv97j3RLRR G0ZKpLHZTEBNQfwx/EKNXo1EpPIG+6WaCwHHH9Ez4uGyhaK4P3sBZUfCsE15pxZM WTiwwhF6Jwc3Z0ZAMqc8Y4VaDPmbUWJr6myMGdc9q/hv3yqTkZdhZRmQG9IrHNc3 pdSEpiFuE9s5KnIuomGNe2MN/r9/K+jGO1KfgEGkYTpFvjntp+4wDrfgjdLkXruV pDzphlboEcxpdJMMyoZ2lCh5ybbpH5JuAd6WX9bdZ5Yf43/NIbNkvenHO6SBWURP UO14Wq7MqOhYl+6dv0CbRr3wKWIdpT2ytGAROQ0okjD4F5XOZuyzS51Jr9c7nqtR tUX6k/Lje+csGszFJ4HmHVHTH0sHMxOZ1p11MaRS1s2AB75l5zaW33xkjlqbfaRn GbBF04Rtnxp3AyiICULhfXVI05nXdlgJxv9cCBnPntuUynAG/S5V9w+ZKSJyIlqZ 630V/doYff3O5g== Extension name: g84854 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7EEF930332CB2D68

http://decryptor.top/7EEF930332CB2D68

Targets

    • Target

      e7ddb20095cd733efc10fba3ff1a8b3e83767cc900b5a976d4029456226612b0

    • Size

      158KB

    • MD5

      37c62627383200afa90abf92bf5c4f72

    • SHA1

      ba0cce7a0b27b4d6c29abeb6d02f5bc54c6c8cd9

    • SHA256

      e7ddb20095cd733efc10fba3ff1a8b3e83767cc900b5a976d4029456226612b0

    • SHA512

      9eb9aade0df35394f2b326d630dd24899edd388c7f19f7da81b99b347ab402994f0ed4540c9a8bf58f2e1abada2632e98b714e615e25d71ee5892d2cbff16fca

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Tasks