General

  • Target

    df35134822bc19db1a2f59f58c3fcb8a8c0cbd6d7068303c5fdcd428e7b73619

  • Size

    116KB

  • Sample

    220124-a7149shae5

  • MD5

    b0e7d1c76589a699d506f2dba2f44e0d

  • SHA1

    d671e43a138284f23798d470197baf920470b08b

  • SHA256

    df35134822bc19db1a2f59f58c3fcb8a8c0cbd6d7068303c5fdcd428e7b73619

  • SHA512

    c8ef5acbb25dde9efc2ba9e51590278bd9e4fe8e9b8d801fb625b94249f6f037506ed1a6280d6c748dbc609d4f19e1be22d4539daf9f0fa3d9e255a0395b3fef

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$7JScgxC9niPjV.ewfyxyqOlWuDvfU1bUfT7ESo3iZmsNFjKJowzJO

Campaign

5212

C2

ouryoungminds.wordpress.com

softsproductkey.com

zonamovie21.net

nurturingwisdom.com

2ekeus.nl

tsklogistik.eu

burkert-ideenreich.de

oneplusresource.org

jbbjw.com

dr-pipi.de

levihotelspa.fi

jacquin-maquettes.com

jobcenterkenya.com

sportverein-tambach.de

blossombeyond50.com

yamalevents.com

esope-formation.fr

sotsioloogia.ee

vitavia.lt

smogathon.com

Attributes
  • net

    true

  • pid

    $2a$10$7JScgxC9niPjV.ewfyxyqOlWuDvfU1bUfT7ESo3iZmsNFjKJowzJO

  • prc

    sqbcoreservice

    mydesktopservice

    sql

    ocomm

    firefox

    ocssd

    mydesktopqos

    steam

    mspub

    powerpnt

    outlook

    excel

    msaccess

    dbeng50

    thebat

    thunderbird

    tbirdconfig

    dbsnmp

    oracle

    infopath

    visio

    synctime

    ocautoupds

    isqlplussvc

    onenote

    agntsvc

    xfssvccon

    encsvc

    wordpad

    winword

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5212

  • svc

    backup

    memtas

    sql

    mepocs

    svc$

    veeam

    sophos

    vss

Extracted

Path

C:\rq28k9g17v-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension rq28k9g17v. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4A551B93F39F4486 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/4A551B93F39F4486 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: qyhWn4tU5ndtbSe9y7M/vflB90BFUVTHVYmNrWpvOYbS2sdd1oFJZ1DsjNvbRBxQ yPMABVowsNWJmRtWUBZywECKXU/oZwNgLglcfDM62x+6i81hfGQZ/AZvIHOpy+Sx l+wEmGMYPiyM8kGIgSiJxvOf+aqth8oPo+8ignxqYWGviXrNueEd/9ldXAUy56n6 jcug+bEN7VWbiTu/ME9ZtHo+D4Xlr2tkPFy90olr7qLUjlWzoq6Ub1lqSd0yINXi XkuGtzC/trSugyXRXMB+eSJdc7gS+7ok6+jevPwpuHKR9cDNv1wiP11f2Cdfy7rp m2FUncKjt37MGO3rzJto7o0RSblzNQsQ+/SAdV4WbL/9VU+pHAa2WV2prTEiCCZT +p/HVmiDASel0FvopWt/6Y6on3rTcBqAhoYCUOO7xQHnaWHtVkhfQc7q2dDc3zx+ cqyj4ZY/KHhtSYVkIgbnTzCuPbdlZWIlBUqCGlobsAgNQsXnNhvANtlpqBM9JK+a RKUeKHz3T7Yb7kNI606W7opUkza6oNoMAjjbS+I0n8B1GxxNmdHhgr/EI5h7yGag MN3Dgp7Tk1nrxzBPc1veCCG1UxSyL6HsyCtWdxE0Wso25jqoKRqrwFhiCxNjqR54 RBP/ZXyT7KRNxVFXCcvbNR7wv0CKWx6io9mku5OYBsBK7/WZxGKEP4LiElinPLs9 fUqc7RPC8Q1MfBBSwyZZt9vxFr8T4n/YF5gyih/VQTQjsZ8gUCIFYoy8XjwSdVu0 HXZE+CgSfm3y1QHFQjvdTN4gGDUqEvcF84u5JcXrUoEIPX+FZINdLUZb28HVOJ5y sske5yB4TRjd6K4zjOSeNqoKFMNw8oJ9kpYiSKWW7Rdre6C7EbFCZmMM0yk8YpC5 DYOe5Jxwl64zwLKxL8NL2QAU0MYTjEaS85GAv/3kPEcK34d1vLg+tbmuYLkMDIT7 acBnBCIoWdB9noFMLyXZ26CEnM9crtT25gW9Ke1H7Eg4Hox7TENHCbb1+HT1M3Fj H4oOPwrc252J4Xh6l57cvqoD/uBAqJXtdG2nRfpAOGMq2HPjsVMARz/R9mKQO4ZU RX3pO2n7HYVCFnpyAcR9IuW21ovq1V/PTDloV7ntOJginBBYS5LCn/UwV3hvU1Ox iH/tZtLRIpH82m3YmH5KFn5xKiJ291b/gDpaIv3T2xk65jZ3Fl9v3pB9FEkPa/iW hV/c0DMws6VNxCvuMjVxxvaznfRZE4Yd4Onih9G/Cj/rvB1w7A0DvYDnmUrlWoHo hVAzw1PuRsVdaJguNPcWCmzmKb7ZU8/w4SKN9mW6lB0= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4A551B93F39F4486

http://decryptor.cc/4A551B93F39F4486

Extracted

Path

C:\409eq22609-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 409eq22609. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF16CBF7939A2B90 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DF16CBF7939A2B90 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: OBspewBha9OsNsI1zoi+31L2b0HGMk93Ac019vdqXD3tsVBdnZeXmSw4HPL1p/bn LKSj1c1/8tfeZIsB+lgeRg/nQ8y8GiNgx7E9FHFUtphDOqKl0d/Nrk+AP3wwaH4g LhaFtXRp1QX06NiIOJTK4w5LBXzCzvn6Ur9wHqdVn3N6Jipsw/jTFRG7rUKltxL9 M/E+vT6t0VLIDW1pYdMiTBI5q/NnNZ2vrwdJN1TVosy7yR/JBOCbnvs8AY1O8svn A+0KrdYjj5hfPtzv3H1FL9H5wvBe9NQYXY1VK2j1imHhvkN26xLjNXFwlYWT9BtK kz1cvvS6918Yt41IQWE2BSFYImB4MsKdMGzapykIYfgDYBL0jDDwyVkZGG7aRr42 VOyK6/OgHU2DRNmS/ZK940r05xH9o8g6VDdqznfnz1+xz+TyceJee8N8u1cBDm4b HzTZcRC8b4vCuQq+90kRheTZ1bc1+dp84Pc8b52KS2suYR7PM7q90hD7Lr6Ugekv m36/lMgMYFQqI6K10uyzhX81rudkgcPN3ExSHAf1Deod85eDIYiJm1CL1OsnjRO/ XghNjHuWpk368WxnqE0ewZXKmoRp2Ql4e5Cos3yQ6wU8gsrzxZ/c58KiZKo9lpvF XAuWpl3k3mrVwNbKO/kQzLqTJO6mIClObESTrhTVLWqTrnK4KuEnsVzPNfzJYq8f YQPY6wAgxIuelc4Ox5ArT+uPaBvk8GBAVYXVfjIANykoH6tPZRS17u9hOGXMi2PL b4bgQdjRoK00eIa8vEzAn3Hto/6mgVedITCgh2Mem2Yu4LRYSzeypyGaGHpIfFGW Tuuxw+qv4rQTjyz9NTBYbnvHiY657SzLhyILTSNkqWZsLp15RJcZnRLARqpxlf5n tl4qNxy4ZZF0zMBxbd88mI93kcbLPs5p9LU548o3PliZPK6x2wxdpZERbiKCeDVD joyODejltxYQ/CB3ngsnemnUbOC7NSi0X/rW2+/Fg9Ebpht59OMqv0Fow6MRuqHt KEgAKu/U2gpOnl4v7lmxkAaSCe42pzEj/PZN6lEsmfONUFA58urkFYSI+yvmtjHC iREyx+UbglGTWwqaC5Ri0up4kxb27pmhQAcA9YQSrmbl/nTA14dqATvpOOQH3EXL ser/WiFzPjmzooncsH/ahr8g1QhOP3wXB5RNz6vAKmYs1x1voYfbTMzQK0Bh6Qvy YmG4VEzOytB50SJ2z4TR6n18PdT6d+qEWyBGhAUD45nbymDWTj8IOKhDXazdyrkC uzZmQ/isZCtV5UR/kfxEJo1zKYxmalr/ ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DF16CBF7939A2B90

http://decryptor.cc/DF16CBF7939A2B90

Targets

    • Target

      df35134822bc19db1a2f59f58c3fcb8a8c0cbd6d7068303c5fdcd428e7b73619

    • Size

      116KB

    • MD5

      b0e7d1c76589a699d506f2dba2f44e0d

    • SHA1

      d671e43a138284f23798d470197baf920470b08b

    • SHA256

      df35134822bc19db1a2f59f58c3fcb8a8c0cbd6d7068303c5fdcd428e7b73619

    • SHA512

      c8ef5acbb25dde9efc2ba9e51590278bd9e4fe8e9b8d801fb625b94249f6f037506ed1a6280d6c748dbc609d4f19e1be22d4539daf9f0fa3d9e255a0395b3fef

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks