General

  • Target

    e3d63d0a1779743676800d203980edbcb2cabbf159df5555de965f425efd0895

  • Size

    801KB

  • Sample

    220124-a6ql5sghgq

  • MD5

    3bbb20d2a54e6bc9daa290008899c9e3

  • SHA1

    25a76b9835a7b3bf10666230122b9efea79c840d

  • SHA256

    e3d63d0a1779743676800d203980edbcb2cabbf159df5555de965f425efd0895

  • SHA512

    4a6d3df419a4e33848ec21840c1ed3797801ef5797e73ed369daeab9a7a95675b202f99cb18a8606d4209eb21d43441150101a47279862662cfd8658767f0be8

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

Campaign

1428

C2

ecpmedia.vn

triactis.com

promalaga.es

siliconbeach-realestate.com

bigbaguettes.eu

web.ion.ag

spacecitysisters.org

abogadosaccidentetraficosevilla.es

blacksirius.de

sipstroysochi.ru

foryourhealth.live

schraven.de

mardenherefordshire-pc.gov.uk

pubweb.carnet.hr

joyeriaorindia.com

makeflowers.ru

seevilla-dr-sturm.at

podsosnami.ru

stupbratt.no

jsfg.com

Attributes
  • net

    true

  • pid

    $2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

  • prc

    sqlservr

    excel

    sqbcoreservice

    powerpnt

    mydesktopservice

    dbsnmp

    msftesql

    steam

    sqlbrowser

    ocautoupds

    visio

    sqlagent

    thebat64

    outlook

    dbeng50

    mydesktopqos

    onenote

    sqlwriter

    tbirdconfig

    agntsvc

    infopath

    encsvc

    oracle

    synctime

    mysqld_nt

    thebat

    xfssvccon

    isqlplussvc

    wordpad

    mspub

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    memtas

    veeam

    sophos

    vss

    svc$

    sql

    mepocs

    backup

Extracted

Path

C:\42y09149-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 42y09149. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/23DF098170DFEEFD 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/23DF098170DFEEFD Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ohbLNnqwASpXH2L+G6EJKLsW6GKDTUpVBulmj3n720NXOcBGptxD0ieKGJtHcLHA /D0qio45QKl+KBlxV6AINUl0CYh2jGc7pA0gfAHHpAOsgJMZRgqKqCiIf54Qp3y5 KPgTVzTn4xnIvWuwZHMD1F+QDJ77fCvrDgXpzBu3v00e8AFECwkqYTotOxRq+uCu YO57K5rNU3Iv/6ZtHQJlsKiyCVpL+Vwroo0dOrPrLw51PP4Peaou4Z9lWg3yiF8s SWLg6zt3/EiQXh0dpHxi3TGGs19bf2BuyVkAn4hPD93aMYnos83x6ZWykDCfAxkx WglbVfmCM84mscpKDpEeevkudDsctWO8fxSP7nkp3I/fK8ZCl6LtQ+4POCniYWhH I/PZTc/GjE5GBOjP43pl3nVmSMUQlpIOcSZoJLo6jmfXru6ZCkcwxETExUbJfmbs xcNXli6ezPLihSqrsap/RLiuOn0HSxrdTXyaV5xzAU/IL062UVx62DI9oyb/KFC8 UYztsmOtJ85EWAJg4ajCACte3qAqjvTZOXxfitjFJKYqoQrgc1zt86pBbcUG4Xs9 X+wwgzZ4L+HgoxcGbkS/PqaKRHBe4qdvlp9vPd6mgq7TwrDGQovrq07Lni9cLCMk fZ6EeSpuqD5MHKUj3mJb8JSU83XntyykRcz4M4jumD6hKhErS5acqkulAMvVE8sB 4nSz0jzx6I7REdQuS1uGSxpIuyxmZYpCpgUPOFpOcsFh7Uj2rT6+IcQXj7p78PWr vCbLSyG5IARUNUlx7SACorUiaR0TSpd7/pyNlnCY+1bY1xMYTJb2r12lPhB2ZWo6 j3x5/XF7qnEglv8mSPLuQXZEPzzJwf0Ys4TLnuprZww+zrhGEnz/6Ft7oGvUuG9R PjRu8zDG97sVQuiEPfxhkd+ofXnCtogvsYL8MY/rhfYv1DWZnFYFazFlyuZxKbhD hXlCcUsWKygiTE5H/GTWdzJc0Tx38A3DRc0pOj3i8g+0JQD6vXIIYPBCydow8AJJ IytuDjtIAmKtGOJ16zRdXr0POESQXXUHVumymRWdJzRK+yuNsymwOm2gF4xksEts KeI8QyeJB87T7IfJcieQg3vPb1JoKqIniE9nNSCj5k5YIiyjbcujTabSmwY/ECcG cvcZTAT5vpfqRDEtKvQsd2gT2qaCDKGtPD9miRV3zYAfRxTsvh9FHzow3hditJIw mjGJILChkZbF0r7U02IF166antlEQEZxEYWtVSXTrqhK3i+6TuY3v3Ugcmj+G/xW zTLOaebStREufQkfy3NEI1unPlQGoCGAV+VrQw== Extension name: 42y09149 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/23DF098170DFEEFD

http://decryptor.cc/23DF098170DFEEFD

Extracted

Path

C:\93n14-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 93n14. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7125E1BB6491D41F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7125E1BB6491D41F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ocA5VeQgMKM8cEMV8EX3Gh0OcvszO2Jo0IK9Nx4W3y+1GJlQmCKezWGoQ/7fUFHQ N7VLaFQfH8mNBcQxpQU0YG0BD1pMNAeNPH81s+tzR2IBzGHYoC3cB/CyrlaJ6YRU MhJUkBH7jezibV/ExyDSiSygs+lfdgx7YOyO/lON8JzA/3ZlcgGKC2GdfSChzA7f eMnQ/Bgw29L1AG17FjeYSwpu+0RuumGHarmjc3KBob3+rk58TB/0M3l8OK02Kn5Y IbQNLP+Cx4jFN7jNXhxHAKkOm0EWnNjBoaGyAzQMmVEJQxkrOIi2YZCJf3QG7tRW 9nCUU6MnczUUuaA7dEFVEFK5Tbqf42Kbg/8Ylk6qgPmQimbKq+NVUZRQBS0esN2K mwluyNLKNjBsUDIkiLTgL0lJIjVPzeWz3ASXyeE1Ly3c2CKRy0lJg4ElSJ9xLssB b9qyq6IPKk/t0oSlhQWOQTX6i7I3sjR6LzyqCiEATl19nR+2wkQdlTJki7vfoPLs vm2c5cROvfSIQf4Bdq3mZqKLem859MhfFsph5CSW6F1dRmn8MXN/GIWMTXTDeVXb zHbK8u0/P7Dt2/yn//LemhmhwJanwdKpDoS4Nimr6ZKID/GvKGhqtFa9e9+/b/Tj a8w8w0ANWq2jeycMVL/S7FMv7gzC0pn1M6PqzyxeIyC1cH/m4pXugMTaHkVg+RK3 BRQZItlhnPu3ac+HY9TJcvIRUrESDayEVrI96Pph7HGaLQwAUIQwNSPrub5r0aNj 8rA0hlkdNqQvGyZMsD3zc9onwxxVTn3nFjxbdc+DEUyfqSpenXzBTX562Hx+s2OF Irb2AThmnOsaNwZ2drPLVSI7VAuKj19ee6YfbqbsBAaHKkLE5M+jREy6JuF0s7Jv wYXElP+pMIAYi3R7/BWqjU999gldnKc+YNoelN6NQkNWn3EHtd77exlLs+evH0/t VAPK/OQrFsxlp50ESlnxskoBeNhAXSHNOkYuwDKN2SNfkyJIJ2AcP6Uma3bnGPrY IXPLvqcyWX/NMwzAUIHICx1u0Nca5YQf1BpkUP7jXraNC0fRPnwPJ2n8R8fmy9Gb QlVO2m6hnDhut1W47wilGfVvm3i7QSC6sUajnqOZCoCTTAWghwDAl9oeu28Io2Ag rKngDCKqTwpGW/1WyrvF41cU3XMlDujlCUIIbRdVIAehSdfRR7b8PkEr2NagLhGI O7o2JMnU4H6AqmEiszaO5PdfYKKnLoZYPXAPONn/Q8rwpjNsbbNx60BzkQHfERxN u7XAMJvyMvb3+OU7GEo= Extension name: 93n14 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7125E1BB6491D41F

http://decryptor.cc/7125E1BB6491D41F

Targets

    • Target

      e3d63d0a1779743676800d203980edbcb2cabbf159df5555de965f425efd0895

    • Size

      801KB

    • MD5

      3bbb20d2a54e6bc9daa290008899c9e3

    • SHA1

      25a76b9835a7b3bf10666230122b9efea79c840d

    • SHA256

      e3d63d0a1779743676800d203980edbcb2cabbf159df5555de965f425efd0895

    • SHA512

      4a6d3df419a4e33848ec21840c1ed3797801ef5797e73ed369daeab9a7a95675b202f99cb18a8606d4209eb21d43441150101a47279862662cfd8658767f0be8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks