General

  • Target

    d976a41f366fb1e3a0a5d15878d84e24704949973d9e0ccead9a779dee03ef0f

  • Size

    165KB

  • Sample

    220124-a92htahaen

  • MD5

    e2708d3c57b562b01da42f9e7549781f

  • SHA1

    3d82951dbfab5629187b26ecb7388b7a05597f67

  • SHA256

    d976a41f366fb1e3a0a5d15878d84e24704949973d9e0ccead9a779dee03ef0f

  • SHA512

    c483968f981e64021025bf4f42424df3cfb88a55bd4cb7f2aa904515eccb85e239c3d44812b28d5b617b6b8476dcc3f4258465a211ae6e6725adbf1850234619

Malware Config

Extracted

Family

sodinokibi

Botnet

48

Campaign

2047

C2

mrkluttz.com

subyard.com

fire-space.com

verbouwingsdouche.nl

cincinnatiphotocompany.org

promus.ca

ygallerysalonsoho.com:443

olry-cloisons.fr

parseport.com

mind2muscle.nl

lesyeuxbleus.net

rishigangoly.com

lifeinbreaths.com

kenmccallum.com

sochi-okna23.ru

ledyoucan.com

littlesaints.academy

from02pro.com

innersurrection.com

azloans.com

Attributes
  • net

    false

  • pid

    48

  • prc

    excel

    outlook

    powerpnt

    dbsnmp

    synctime

    mydesktopqos

    dbeng50

    winword

    mspub

    xfssvccon

    wordpa

    encsvc

    isqlplussvc

    msaccess

    thunderbird

    sql

    thebat

    tbirdconfig

    ocssd

    oracle

    infopath

    steam

    visio

    ocomm

    mydesktopservice

    sqbcoreservice

    ocautoupds

    onenote

    firefox

    agntsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2047

  • svc

    memtas

    sophos

    vss

    svc$

    mepocs

    backup

    veeam

    sql

Extracted

Path

C:\yj2k2h4d-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension yj2k2h4d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F2E4252EA90FDA77 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F2E4252EA90FDA77 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hHUf56+cBKOXWbWas0ZBhmqfJ0v5/lASQCtdJYkglACT8mtr3htOQbvdytUGI0Cb fOKjny30nYZmMiDBCGMzd0sS2F1KEUdQwJhfYtCuYdriHRky0GT6yde7zfgt/iFL EskGZ9INlCOVsKn9G5/JaBBTWMQDlAjagVdqXZk6y8zP9xqlL3iUF0P8Lqm7f44v Qp+rce/ExNawFkfBHtxR6lFifWxWcCYHQDuoFQPKk/DYeZ0HkdLhF5PwBSHNXSd5 KiUqMvOzdPS1/WyM362qEtwjsjFGBJO78Tfm1pkqOkMH+z2O/ciT4GHZgSt5JBD6 o56IvImddClCmzulLuJtWI8HQqWhCshM6KYQ0BzB7Yqt8ewFpa1fJz1utIMPYYHh mBhcTsqHK7D+4qNZmeRHApLBzVL8y85+SwCCoNv1p41Kuht20c7VW2J4MSUbXFBB fiUXX2oVpbsDi9o9B4WGgiiyzUdhhdiLTY92cu8Yfu77g8uz7Zbs+CgQRa5lQ4Q1 Ewcj1+g/aeAPrHyJ1DkjJjEq6NoNlJxU/7qSPZ4AJWgvk9lHNzuq25yiUu0LAKlI MijN+MdjZGBI73OD862UGh5Lp+KNCtBCVTheXXR7D2UpR0BK72SeqQW5ik/AoARX EviD0a76LIrIQ05t3PI3GZIuN2QQZ2lYzu9z2BCz57jC6KCaz4/aFTL91IGnl+MQ XMTjjdZfcCt1OLFTyZylmX4sjl82+b+EgmPA20FySG/dM4eGz97sM7xXYGKP8RKR cee8JuxJwgVtHQ/9mKsCUs/kqxzdGiHXs5cQyqAHqgWIbI+CA1NlFpcXjwaJMF2b AazVtpsbY+ZrqNBeg+9eLQJyOZQDijOhA3QsYpCKsP1pqFiTarjdTbeYniOs0KsG 9yK4l5sFQkBLuB1ZDwNp6729anrDpYLpMmif8VTKkJSKOgz2mUrMMiUnDp1CTWbw TlekRihj3rkFJAtufPYRcKvajSWzeBpt69bRJVj+R6ak28Bw5wZ6jpmLGIG74h8H FVPJm3icEHimSVgnlJoxBYk+1D3HKgMLRwNXqwBBF9euAgR2ql0BsSgi0WXMj7yD XyZJSh76eSpJOwPABWFln6TlIQnZVU4noJToSbMx3QUMUKQWGjENLrXwVQx/KBmF 8ZUNVf32BHo= Extension name: yj2k2h4d ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F2E4252EA90FDA77

http://decryptor.top/F2E4252EA90FDA77

Extracted

Path

C:\10031txee-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. CDHFUND. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 10031txee. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/40A25E971E57F6DC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/40A25E971E57F6DC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: lLt+ctOxzaaZ2mb7w+F6UyuNqrvnYSFBNc2Qd8r4UDbxU1f79Mj24AoXOkcFt6Is Is+udKTruGMfYDYucQPxaVz+by0i3BRdw744cl7sew6uXNLa75r+empxPxWHVLEl j7qV01H2uN9NI03januKYwR3JPR8OAU0HmtdS2BQu2QAzuuTnjdli8Xv9SR437H9 fBdp7RqjdAbKLruyUMeQaNekIlDUa5DOGWynye5FSf91FShmWw/f3z61gyBxzcYS 8kpMUkQiDU0snQosuvZ8Rr9/SmL9CbXyVAeByaINJufDcvgfBLbSi6Cf3+l74/8w RLyEht0557ZYH2CvXMVuVEQArHAnfzgDrlnVlqbSYs80aoOYzGTRQ6CWVz5mI78r 5va5+STtaspSAtjn3UtLV3meL4VgZJUQliQuMg27tv8qAUKyeFVDSykhgrNo8S1J hHgLjbYa+f3pIZgd8CNHXX0TMTJcYdaY3x6SK8mWliDvSWNWqnnQSdnF9dS0Hx2K /+zHoIlRriM0e1xu8U2Uy9We7b1e64E7H1KgidNOAgiuLx2rfLgDC+JpxTM9YWUe suzdru93DcPjbS7v7yI55hhVomd547YxL4UwkJQvNRASaEndAHvjucrztZGsHRlZ bMr0Pmu030pEgNJ8xDi4ZKYANsPTeCmCIRb/rh2pEGa1pF0IxV4i5mvMTqnu/qj0 VrecYJQhvTuVY0kla8Gy9M0jZvb0b76tnTZe73tBiKJwD8vn0vAEhXxLrcxIb4ME 0a2LQgbMytKizGFc1Ud1B9B/rk5Sc7OmEZRyuMAzzHgPMFvlSAYV9rB14REMp+WD KCnntacO1251K8+3YDvgvCFBWO9j9eWI15PYqAaiMLX7VZQqr/P2iMZjJfq4Ya8s 3qxPQPPNHJRC1O4DrKN6cK8Grsyu1FFNTAG5r0eK3yDMVMkaLr1PPL7dat8zvVSu 2Q3PnOjmRqvFbgec7LsOHsfy9e5Hnw2Z8ub9ppe2i+jturxaIJtf61hNY+oryNXs EiqbJOWYc6MJOV47Y6zN/w2xLXUJ1v9Plsi/+yz6Ygyf5ykvSHDWH0Pf7f9sOIqm rNI+HSph2cPw9/wMmFRgQn5CmBTveuiUrErFh8Rl37G3ku5yFBekxYi+zfcIFBwJ x8U= Extension name: 10031txee ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/40A25E971E57F6DC

http://decryptor.top/40A25E971E57F6DC

Targets

    • Target

      d976a41f366fb1e3a0a5d15878d84e24704949973d9e0ccead9a779dee03ef0f

    • Size

      165KB

    • MD5

      e2708d3c57b562b01da42f9e7549781f

    • SHA1

      3d82951dbfab5629187b26ecb7388b7a05597f67

    • SHA256

      d976a41f366fb1e3a0a5d15878d84e24704949973d9e0ccead9a779dee03ef0f

    • SHA512

      c483968f981e64021025bf4f42424df3cfb88a55bd4cb7f2aa904515eccb85e239c3d44812b28d5b617b6b8476dcc3f4258465a211ae6e6725adbf1850234619

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks