General

  • Target

    df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07

  • Size

    164KB

  • Sample

    220124-a7vbqahaap

  • MD5

    13d4c1451da6fa284c08c669a7d0e7c1

  • SHA1

    2ea65287c7489d8ab5abd04e172c55d1518a4052

  • SHA256

    df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07

  • SHA512

    f845335dd84b5bf9b20889dfd051bf012dfcf96adaf4f6de171b3a8e62f42cf03c0e18314ad6ca59ff3eb5e1c0ef3dce179845aac6582b9438c0b13809f47554

Malware Config

Extracted

Family

sodinokibi

Botnet

6

Campaign

1402

C2

vvego.com

catering.com

animalfood-online.de

mazzaropi.com.br

agenceassemble.fr

anchelor.com

duthler.nl

druktemakersheerenveen.nl

smartercashsystem.com

slotenmakerszwijndrecht.nl

ijsselbeton.nl

azloans.com

makingmillionaires.net

hnkns.com

elliemaccreative.wordpress.com

forskolinslimeffect.net

precisetemp.com

mazift.dk

selected-minds.de

agora-collectivites.com

Attributes
  • net

    true

  • pid

    6

  • prc

    veeam

    .*Tomcat.*

    .*DogGuard.*

    .*SafeDog.*

    svc$

    .*backup.*

    memtas

    vss

    .*Firebird.*

    .*firebird.*

    .*SQL.*

    sql

    .*kavfs.*

    sophos

    .*Alert.*

    .*cbService.*

    .*klnagent.*

    .*Sage.*

    .*Mongo.*

    mepocs

    .*tomcat.*

    .*Backup.*

    backup

    .*postgres.*

    .*cbVSCService.*

    .*Sql.*

    .*Notifier.*

    Apache

    .*Postgres.*

    .*alert.*

  • ransom_oneliner

    All your files are encrypted, additional information can be found inside of {EXT}-readme.txt which is located inside of every encrypted folder

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you have any questions, or experiencing troubles with the test decryption, you can use our chat on the website, our stuff support will help you as quick as possible. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1402

  • svc

    .*klnagent.*

    .*tomcat.*

    .*Sql.*

    .*cbVSCService.*

    svc$

    nginx

    .*Firebird.*

    Apache

    .*Tomcat.*

    sophos

    .*Postgres.*

    .*Alert.*

    .*sql.*

    .*Mongo.*

    sql

    veeam

    mepocs

    memtas

    .*Sage.*

    backup

    .*oracle.*

    .*SQL.*

    .*Backup.*

    .*kavfs.*

    .*DogGuard.*

    .*cbService.*

    .*firebird.*

    .*alert.*

    .*SafeDog.*

    .*postgres.*

Extracted

Path

C:\1qfhx-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 1qfhx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you have any questions, or experiencing troubles with the test decryption, you can use our chat on the website, our stuff support will help you as quick as possible. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC144886DB9959FE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/EC144886DB9959FE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: cbAkvfhlv/+PgCsMZXggKz5vlTm29l2z6MlIJ7avuBMk5b4KH7ll6+AX39uLheXx hMkPD8gdjbyJUfZ7f7DMBpoO8OnJCoUJPdNKXu3UHRCfQro+kvDVeenaeNMiedB8 oGFZbiq8Y3R879ElBING73nLMzaGAUb2Gg2gdEBG9+4Vj2qa5y8DU9NXFWrVX8Zg I86sG7N78o9mdXVW0rEUfLzPu8Mwoz7ANacxyJlsWtsNQhegd4MsvoYVSkmNxzfx TfWwMLqcIAalCONXs0Fq/p9/KREeBXtMT8utBVo6WL7tv4aEUPPEJWSjqiyv/IF5 5nKz/1Ly8alGcDxAVHDI8WCBMePzFbCVotSZ8jugYVqzDJFl9pc+/zAnhC4mU2UT KTyEENxhAMdwJXNnPvilXXR7gXSp3rkYbfGn8tGfGXErtWMHUzlFMMtEQVHqCGk4 vQucba7AA53bWhl9IkRyfUwaGP6x+00P5xJSTQ2cuJjkeS/npXwLwBZoGzesxIia T4uTaDMuoAQrtEUg7AH1551jMSa+hLAIWPjRimks997cqyb1pFfAeaFCvIxjJ//j XbMxYrhH2QFYLdKUNM16DCunnaqhWcZpu84FyOdAOZKrSQnMheD+3xQS53iJVzy5 +zXJf4MxrFXZfIMbFSt79rG/tp1IOqipFWjYwbhuJ8ZHmqKxToJEAcVnZ1BcdMoh RLsPHsSOThjqiAYV5oJsVE33GPAwn3pRa4fQYdzUzK14Z/leKtvz3YrVuwepbYnz N+8VXSEtF+QRpfUj8ZYKRqkdCfEy70e6CtJlnJkW4hrNwJqfv6NDWqIfvqEmww12 Ae62QH6Hj0OShYaba/Hl7TMUa+H3wg4Hbh69jLc34rPjDj9fDU3CMiFV+wDL7155 ntabiH6Y1SQFg9PL/g58xyD+Z3VFbSTdHEnryKmOJzE0zvxmDL77PG52Rv78NPre /N2V1gdmRqVlCH4j3BRmuGlmy1ufbB9tHzQZHt9rXOy5UlfPnqAJd01GOEq5y7B1 2tZwuF3bTi4uPKzCuyaz4sd2fE7nAFTa5oZf7epIX0zNuxcQtBj+ryJqMGuGMLKV /b+CZ0OBlrAxJFck9aqIN8RTLJdxFym5xNhmCpf7Kow+30J0QORqQAHmpymRzKI7 Extension name: 1qfhx ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EC144886DB9959FE

http://decryptor.top/EC144886DB9959FE

Extracted

Path

C:\ygkpvai-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion ygkpvai. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you have any questions, or experiencing troubles with the test decryption, you can use our chat on the website, our stuff support will help you as quick as possible. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/26DB6161C15B4CBE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/26DB6161C15B4CBE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: vuQejG0f51Vz+1QGBOz/qn4K1lj/Qg6itHkx+bsAyBFdqcfYJUwJf8tH0Khmh7gF 5uyhxPo1YsK0VpJCaZFO8zyb+nSQhDlRgLP6J1OeifTcT7f6aKxa6RL12puIqd5v kmhqQ5WFCy+7Bi3/FRtcRAyWsa7x5UOOk+HNQZhGLHmaZhpKYK+z8G4vejRdftXH DaOpC4iNYyz7Fhcttxs4e/Qud6BtUJzmo8U2LkjfzVn1fqobKHsHhUSVnFyj/SkM TtL/U1KYG4igqOo1QV/hsuJIKWafO9ICowHFZTLce2Y1U8mHRDicYRy+VKVjECRA mqDE/ffIIDTFnfrT37YM7j1n3Wgf9c7QQOAo+Zbwkr9tQHleJoIOan18zxWryQIG xeBAx7CIzhTdbEUBR02Fz32YYXVxGutBcty7SO+ZslEsKKBpFt6CygOr8zP/NGX4 2HDGrlV2B53ncgYNoF6YIsIk1ytvL2jJcFsiopzm/mzI4egMUNW9iB8Za9iDw4a8 NQuGg5btbeAEDN5fWsyh5e4I+lQdivRwAujlFJ8h3h5njHC4GZWl/o3deum64ET4 ZY6YwhuD/1gKzKkA3WQGYv0c5O6dEE0Ch7eJK/IX+K+p+Fa/4fhV7a47sa2iUNcy Nfx0XYkcYhgamzTTtXTk1UbCWiaOZVbZaX3qZGkNEADdwxBoKPB6g2Dk3DeKboxs Y0+vaP62EFjyDNBa8qXmh0Ja5ohpHvdFUvWQat4Ax8HxbhMLWcJf7Ukd+sHm+/MU C9ev9VKASgYeQY97yGdYJyQk7LqIjdvT7ozb9b4UbTC9uXthG6uo140uhY572Iux AVy3x2oWBoxLF2EpgUKocsEIYdhrUy9mnlNf/+5h99INZVNA5yO9Qv31ilT7GdeA hpwrJ62DHH4vIOJXb2sgAYeRmcCOOvS6Unfz6gzjJVGUFW6J2VmcI80+xHOoabEJ MnmLJx85gXUxu3gV05YGLqn7t0yqCs/rGdv+kpfVLsQe83JbPlHmt9IbWm1OY4Bb J3tghOHfJgU96F5zkZNMB53B037U0AJlFMCIXILtLYDGQTKK1No0Q21/aJFmgLVF UXTH16W1g2MlgGcUlj2qSq++jcSfL58CBzQhljv3+yYXdvif0Fhosb0gAMg= Extension name: ygkpvai ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/26DB6161C15B4CBE

http://decryptor.top/26DB6161C15B4CBE

Targets

    • Target

      df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07

    • Size

      164KB

    • MD5

      13d4c1451da6fa284c08c669a7d0e7c1

    • SHA1

      2ea65287c7489d8ab5abd04e172c55d1518a4052

    • SHA256

      df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07

    • SHA512

      f845335dd84b5bf9b20889dfd051bf012dfcf96adaf4f6de171b3a8e62f42cf03c0e18314ad6ca59ff3eb5e1c0ef3dce179845aac6582b9438c0b13809f47554

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks