General

  • Target

    fc60327dd121edebeac149012a66191b38ec0427697c4fb86d4218f6e023fc93

  • Size

    125KB

  • Sample

    220124-az78lsghb6

  • MD5

    997717946529844208dace3d0b1ed237

  • SHA1

    a9845dacc58b6e542bd4972395da06d096246f79

  • SHA256

    fc60327dd121edebeac149012a66191b38ec0427697c4fb86d4218f6e023fc93

  • SHA512

    25b10392315106a234c1d8881200724576acba6d6beb7684dceb2aeeae749d2a55c210988ce93195a2e96904f1e13fc23ac77fd4f750cc375a792aad4d61124a

Malware Config

Extracted

Path

C:\k3fzcjjz0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension k3fzcjjz0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30D5E548A0E9A7A4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/30D5E548A0E9A7A4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: L57saEZnQa/awIOVmvhwlbnLoHJHv/MMH0sJkvrTlWx/x/peLBS3Z/OhzxbwT4QZ S8wM8Q1oWiTtQcVBreRtFPsDAxIc+grP79ugZKdfU55Q6ZsaHr5x8HaCm5Yr3OTZ xEFlDOlmHMFq215fVLdMbkc/lkQY7G7jYXofY0VtQXAGv+XpCG4OIhFMa7Dlu6Vs B/Iy3NBDI3Ed4AwbFm+SeFDWT0XfqafGaoEzZz5AbaY/JZmo2QIqsqLxzTmc1EOX QYf9Kq4irYG7LHCgOudAiFg/V1yqKivH+vN6IyTXYTJuxUqPJcPVeM2/CcFtBe1i jTv8tVva40rJ0U3mNEwsbGeEyivSt2v7ticp3CRy2bVeKiMWZT+pm5tgKnXZZXGu HdP5dfj+vIXuu0e25i61AqOiIgyLpEpOWssiIooEMdgAK6fP0L6CRuIPMd7uTALt f3iQjjHHIOynPoC9I2XoTVjpjxMsGvBiBmnidpD7rJsPLOa7jXx2PxtiLak8cIkL vFl8Ma95w7q5esJBf1Avm6OjWsGcIe2z9ZhZv1PZnPJy9x9mCHFwniPwxUIbBV5z Arq1ZmTkTq00jGGMqolOStnY1DeRgg3FRm0oyzVMEY2xY5V/QH8y9yKXcsyN+Ng9 EJ8J8wkh4rZ1EMa/5HaXbwamsJXYETumRkabafBNqCMHK3y8cHpi8raiH5bC09Ka fNMJalqVAMxds0WsxiAfDYIGXeGw1WbkWMMM3Qbu5oEA2LDZqVTdlZgwQNrGkL1y 0ga2a6Gw2saLjZTNaSggCXagxKExllo3lgdFn3hBiftIHUJxNnZ5afifXYC5Yo/t Q2wqnKuPBbiDKX77JC5fXtu5+9H6x/8gd+fz3A+v1T3n8lH1+5nGYr5abHpVuDji RTEXXzVBaSE2WbNWe/pga1iZqv00iN0FbplbVz3FQDDIqXvLU8/h+5nCvtvVD/y4 AAWZuvqezZQos0wEjPs8DpBR+0O82IW82T9rXwPe2qkKoYriT8zRu/dIsXlISqI3 aGo2ZN5EQFPlNhgsUWNplfsquHJXkKtqqfOHCggRaR4/aEt6kY/baDkOrb71MD8R st9tbUeM0xBAFhWMX9p+NEoAoHR72DgZ8k/xUWNSd0f3xufRukHkGUxQOMIfZzeV ES1pQv8pfjFeLA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30D5E548A0E9A7A4

http://decryptor.cc/30D5E548A0E9A7A4

Extracted

Path

C:\mmxbnkn41p-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension mmxbnkn41p. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/82DED475B74B65A1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/82DED475B74B65A1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hTZLMZgdF3lK/eKxyQWFhYzC7BOSybgf3wli6/eP61E49CquFT7v0Stm6I2i4bN0 W46q0xOrNM2PasfgS3F607Q7wy+zGWE/yEcOa6dBii0Y6OXW4vAnDUfViqndUqTy Bu/E8OIVtgpoI9amGxtS0IyABxnJoStL+z/Akir2mL0acZ6HlWW0iWFBV1hnzT1M H4DZ7leNQH7WxwufJzHBy8DS/byU1f7oNUrnKqFewk/lyUBDV/e6Pm05MIGO4x7r HSwWXQO/kuGzgQekz9TfZeAPcpxmaPiS3EdC4OCH3qc1HLQGquSe6rrdg9KyR3Bz DYYg18phnqrEdcrDCvbdYSXBw7deZOoitntsItjjWKH4EpYNPX7D6uS1krKTlPqP mVj/CigZMx1PjtxTlhKVlrDWV4m5H1GgzTRCT8MZnlTwDCSOqplQ6e8KloaODXCf FHPG6LcyBYpln5W7wjUz4T63zUOyXoBWgpIzfg+OKJT6cb9Sd2Kn7PcghN+q52HX WG076U2/zyQCVSLl7cPBxudwFlIDJ658dnvOwb2EqpsJ9hx91jBwHhL6AJsx30vC 5P9zdE0KYgdnrfJCpPV7HSpkm2ww8eP4EnzHvkUbzGnh9EVFontkwp4Jn40s1bO2 X1LBjZKF0kvoztqa+rizgtve95Sgfoiks3cMc5PxC5+zAJXHbt75IQW1V3lhE3G/ BFbHGyEIn/lCL02XEfmqe1sSyhtYkKmbPBd7v4u+7HQ8BGwM2BcNv4dxKxsQZHfr El4o7KrmbaPKi1sJvv/ry2QLqsbR5Tn/yVutRuK3tzFhGr1HGJzu9WtcKhvvjYnK S01o30i6N2GQ1hd+R297Wl1wguZU8HOEE0J22a9t7BfD18infX3dcjBF+eoPOMcS qAN2A9+uTAmfAK1H08npM4mqTeG3MDidWW4m0PHrq1VN5u5pAQL7RffpKtGNxDTh LaSvL0rWswkGKijQJt2Qbp4gV8Vn7i7sZ8GMNOI8lZtap61jSeM26DnnZ2fX62PY T5rjL/3LQbk6kGYwa0fmKz2XinzxhVoiw2dm/exJZ3s6MKbgx2S+l7PkoYPC0Boj GH0XwWPFObXbIdBYPWDLW4Do27GGVk7SGRcMLUBA1iM+Kfo+REVMGrZf7eAJnOgw T9C9wA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/82DED475B74B65A1

http://decryptor.cc/82DED475B74B65A1

Targets

    • Target

      fc60327dd121edebeac149012a66191b38ec0427697c4fb86d4218f6e023fc93

    • Size

      125KB

    • MD5

      997717946529844208dace3d0b1ed237

    • SHA1

      a9845dacc58b6e542bd4972395da06d096246f79

    • SHA256

      fc60327dd121edebeac149012a66191b38ec0427697c4fb86d4218f6e023fc93

    • SHA512

      25b10392315106a234c1d8881200724576acba6d6beb7684dceb2aeeae749d2a55c210988ce93195a2e96904f1e13fc23ac77fd4f750cc375a792aad4d61124a

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks