General

  • Target

    dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6

  • Size

    200KB

  • Sample

    220124-a8nkkahack

  • MD5

    b4243483489150bd04dfb6099e6f8759

  • SHA1

    cc9448bd567ee79ca1aa1cf18d6693ea8ebf9e51

  • SHA256

    dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6

  • SHA512

    fa165269da281f09703533b9de282f85977aa3756004ed5812ce03d39565b9fdf974d9d3d717bf19a53556e01333c1e857b2527c659f85769305c617f2e527c0

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

Campaign

1428

C2

firstpaymentservices.com

krcove-zily.eu

softsproductkey.com

naturavetal.hr

corelifenutrition.com

leda-ukraine.com.ua

beaconhealthsystem.org

acomprarseguidores.com

extraordinaryoutdoors.com

mardenherefordshire-pc.gov.uk

stopilhan.com

triggi.de

anteniti.com

aunexis.ch

boosthybrid.com.au

bee4win.com

gadgetedges.com

tandartspraktijkheesch.nl

8449nohate.org

simoneblum.de

Attributes
  • net

    true

  • pid

    $2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

  • prc

    excel

    mydesktopservice

    sqlwriter

    ocomm

    powerpnt

    oracle

    mydesktopqos

    ocautoupds

    ocssd

    encsvc

    mysqld_opt

    msaccess

    visio

    agntsvc

    winword

    sqlservr

    tbirdconfig

    wordpad

    xfssvccon

    msftesql

    firefoxconfig

    dbsnmp

    onenote

    thunderbird

    outlook

    isqlplussvc

    dbeng50

    mspub

    thebat64

    sqbcoreservice

    synctime

    sqlbrowser

    steam

    sqlagent

    infopath

    mysqld

    mysqld_nt

    thebat

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    vss

    mepocs

    veeam

    svc$

    backup

    sophos

    memtas

    sql

Extracted

Path

C:\4841k-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4841k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9DFB7AF98F96A918 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9DFB7AF98F96A918 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TbtvFZdE0qKpt3s7GhsOsUaB+mm8xhX4CsDkfQPu+rK9QyvEjgiyLZ1gAdsPv0qb xN1PPbnrPrENaWeQ3nq0zsxe/CKml6gZCRUoSQ+4oJHz8Ph34NsXOwRaSqYcWfhX veZtL6IsjAeoBmwqfnUsJBT9Bw7gHUUuu61tHqU01aiUBLVenAIl5svCecFqFUB8 D+K+ppqbryJxfdH3QWfeXNCg7+31ZY/5otWUB3hpt82NV9WxuHef0utMKgnMCavA A56Cm4PEa/USyjj2D+X7UFTV4T4RGh55m8kkmutwdMAlWDbfjP3nRAzwYDQ6/GQn 0uQcmyyqI3QHl0b+stE+yeHW2GvaDFIbQx3Kv2YGhDe28Dcykk/FKR1hfywgeCR4 XxSWx2tzOhgdm5qRJ0m/htMpDosLq5ITvMFwzpXgVCj8J7Q5OZvUShqntc8OLvtM WyUdq/nwflTKU0evpIEHb6lAlqw3tDuHSLW/SS4VKrhlTzqMFdYWoQYDt3Y+F68B 5kP+K/Z/NLbzJG+0WFIgRi8esxDYcYXq87WY6/0yrFKOGWtL/YGxhhgHUMdh/EkD V8lfFtoYb30TRR1AkgdSWWNbN5tID1BR3/9w8oaZbVe69zAZl3qSdqmXADVo4RwQ jjZWPV7hK69BnOUoIgZY8lGp5bgtp83w+TK+nYqylZOgkAOEvPAVkH9ASVWWOOlC WQ7XDpZT/RjE5lJOa8cw6KWtrlr4zfXu7qeJM6foSt4mQuEsGB1R7hZmiulqLnoe MqWXbVZC+6Q4g5GtIfYwuDu+ds6aKfIgnRE4YRW6YC3Np+jIYGz+rWCLRLUZPDU5 pqBeBWAxZipRvnhFmzNws89ActTO7yX8aOLDOus77+RlxPfFbClIhmklVDQa2cDB jgpv1tjF8mZttcE17Eeqlfeu4HSPzNAaYJnYftyCqFTm5P0a5MjcoZ08U4PwkaDI Eo/jc3lX7MEcnNxN2F5+IEGTw/M3xpuGp4ogOB1iooXeO7CFFecYuAt7qBmNhAdT OxvdT2R3E2w7a6AKInDGZ0gaElD8TRNHE1Z1GAUUW5+H7pJfy3rFXlfnv2TzRC1c nGvVJ5hUdoO+1w3dQs2EnZRN61lNyLjBcONXNv2yEhMNGYADHiNf+xJbTBaeCMbZ pT56HYHII+bd7MOBHYtMtxzCsUFMhDu9FVLO+rp/KQTafSWPXgvkObImajWAxSk/ 42MKY+pGQKnU1/59NKU7zyjUJREPv0ClFJWxrGE1Ge9loCcyPn3GqNaPQ/FU9RJf NB5/jobwZRRvelCibyoXr7/pIZt5uA== Extension name: 4841k ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9DFB7AF98F96A918

http://decryptor.cc/9DFB7AF98F96A918

Extracted

Path

C:\tsyoj-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion tsyoj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C52D6861C4A0F630 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C52D6861C4A0F630 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: VvpbDMvkCXpzevTmY/hOfplVkMGwpWqyWf0dKMP2A3/fN64pfZlTv7/05+23XA3/ u+XNoy43b/F6ZwXXTH8WqnZsXw4j7NFIyeNHMHeSThOJOub1gq44HpJA/lNbILns 689/P0lmxv9Qhx+8uvjo0vEBGeOH2nNQUSh6D+M+tgR7IWQwx5Ye1ibFoW8qtgaZ 5oaQ2w9auQdg+y4b2BH6UaDTsPr/05tAkyfDpUrXPMGXaFqsgNt69B+sRY+oeAeo GjGygzW0XBDEcVYmn/9/Bgaq8mHYKPG3bGG6XFUHdDao4kepN91+mR24iGFdlt8/ g0NL35mcZY1NsQhR/O5/u4ZDKvMD6Ad+x389WmHZfW9lHm/YK8xz8BBPnYLDHCF8 65vDBJpd1Xz9R6EtkxoQoaIJE+A6FLvJRtKHFsrKZKbIUOYBcnUFdYQfxB6LA8vY evv5p1bz3ieEQsw2/7tUA9ajy9pT7lX74LfhJn/mQsMMJkyByQ/jLNCgccnMXNiz lWyyJT2xCa5Rj5Qrh7xRUa+bbfCn7HXkSAmmrcbrO0DJ+mxg+SETU8V960D79N7h Cqg5SfbxxrBSJqZWGuFznQsE4V80nlp2sqVRzpsGdV7K0a2f7QwohM7ArTno1Jnw jpAwpdTw8RM4MrhgBKAcv36HaQdVtPS0RHK0uT/ahCQ1l5qyurtczMSTNpi0urXV h+S5IkRsRqHOzh5Qeqoop4gaZ5USSlgMbPSMFfwmYM3D/RD30mTxbDMi8uq/0u9o wvosjmOJvYCh/Zb0VVz6QIW7IL9nLV2JIrGo+88laFFqndXwy4Ps4mE3LjuQIi8n YjvfCg0+C/E2sMh9jASCle6VdHGwIQuIbhwdONIiVJr90UPM0sOpPimI4w9xaxaw NlRYCLwEuAGuN83a+t5tYp8aB8s4qP4JmCo0O2WIXV0pefUUl93TO1/yWjtQWKOz 2pUvcXOQ/LqX/JrhIzd5IKns+D2zQXKnvV+beJwP8YC3+nCsn/jxNKwXuXK/xz9k KDj0DNkrdJmGIBh0dRnwXwxTG7v9BhMsvoqFQ5MqHo9TyyFmnNXOq1Opook4S80N yqLDBL82Lw6vD/LlLAstpqbNkUh11EeApy+5PbxHwpBh7FDWKn0j77x2VBbl136P 30InqqPM+FDf261uB57nVcUdDqfgh12tTgzpQ86pEW3O5WRmABnTIceX03la11Cy SCutQeGbwFjpWsiwqOZuwrn771RglWgqWe/B4t95Bc7uE0msvDf2XFc72Tej+eHR Am7O/MuZcruDGv0xuig= Extension name: tsyoj ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C52D6861C4A0F630

http://decryptor.cc/C52D6861C4A0F630

Targets

    • Target

      dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6

    • Size

      200KB

    • MD5

      b4243483489150bd04dfb6099e6f8759

    • SHA1

      cc9448bd567ee79ca1aa1cf18d6693ea8ebf9e51

    • SHA256

      dd783dd02825f7bbac3faef9e2b07da5320394774f93f35c614465d47054bcc6

    • SHA512

      fa165269da281f09703533b9de282f85977aa3756004ed5812ce03d39565b9fdf974d9d3d717bf19a53556e01333c1e857b2527c659f85769305c617f2e527c0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks