General

  • Target

    8ddf92f666f9ee9f33d44e2d0180accdf97c50911dbec871a35f8e5e1424cc07

  • Size

    218KB

  • Sample

    220124-b1kpdahfbk

  • MD5

    5fb93b9a60f955ff9ee70f1555265b59

  • SHA1

    1a391bf6b975c152c6b70766820dacc7b91abaed

  • SHA256

    8ddf92f666f9ee9f33d44e2d0180accdf97c50911dbec871a35f8e5e1424cc07

  • SHA512

    4eddd9ba0600988b273606dc32bc8ffe86bfacfd12479e066273c38702b9ff074ff5acde0d6623ee28cd4e22783dd7a0183f8a362fb4fb8ac104bddb5cdb2c42

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

Campaign

1428

C2

firstpaymentservices.com

krcove-zily.eu

softsproductkey.com

naturavetal.hr

corelifenutrition.com

leda-ukraine.com.ua

beaconhealthsystem.org

acomprarseguidores.com

extraordinaryoutdoors.com

mardenherefordshire-pc.gov.uk

stopilhan.com

triggi.de

anteniti.com

aunexis.ch

boosthybrid.com.au

bee4win.com

gadgetedges.com

tandartspraktijkheesch.nl

8449nohate.org

simoneblum.de

Attributes
  • net

    true

  • pid

    $2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

  • prc

    excel

    mydesktopservice

    sqlwriter

    ocomm

    powerpnt

    oracle

    mydesktopqos

    ocautoupds

    ocssd

    encsvc

    mysqld_opt

    msaccess

    visio

    agntsvc

    winword

    sqlservr

    tbirdconfig

    wordpad

    xfssvccon

    msftesql

    firefoxconfig

    dbsnmp

    onenote

    thunderbird

    outlook

    isqlplussvc

    dbeng50

    mspub

    thebat64

    sqbcoreservice

    synctime

    sqlbrowser

    steam

    sqlagent

    infopath

    mysqld

    mysqld_nt

    thebat

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    vss

    mepocs

    veeam

    svc$

    backup

    sophos

    memtas

    sql

Extracted

Path

C:\4154m48-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4154m48. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CFE2AA45447D8825 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CFE2AA45447D8825 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: D4mrHElgsGChnPu/fsh0OSydjP+l+CzBsvHeSu/DPfc+5H5b4xbUaIEz5wmXDUkG cebfItOSO5Zuhot43d0JAucGknMKJIVpgHlPikn7SXsguNpvoHKRKqkFeuCLihYm 4MYrrJfFnMLC3cEAzG+GdP18SRRiNJt3Wth5Cec/oUkeEFEjt5d4W8tYZOwIqIEv mhzQ/iZvj5QkVYmdZOvlBRAoap4i/NoFkWnYGMRjkQcVxjr01EbNeyG9iCgX31GI 4jXn52DREYVx9H4Vd8Z1wZI3zE5eZFhHBsfgBcMSp3URnYCACaN5DK5oaviei2pK Heibm+JKkFksh0aN8+lhqaioJNUhR1Vi5JeD/LTHccYJPDkEVk7apyozJfgkAeX8 Em5HDBYlFMP4rD54MlasEsYaeq3UwUgEhn06RfWXJ8dk1V76Xs7y6rcZuO4hZOkI T1zekieCZ8w3D4ankCpuEWqawpzAoizHflpZPG/Jr1TJYbdRvQFXfDjJXIF4/eUx 3JS0x7JXI5xxa8P7BW85gptL3pAB/pmIzei/E1RPWBcK9DPVsuvm7ij57e2agQJ/ e5LcI7l4ntmn/2poCj8sSHWKd+ejR/w2qch2CauAv4NT9G9SGXQiZ14FBvD9UkQz e8LmKbxvveCjIOLxT/RTDc42NaM7jj0Q/w7PdJN0LiNv9Do2AvIJTVATcb+nZGAC 5vxvZwUY7BX+AFLcsLuJYVRL5gPYrbzYEYlL5W9peHy9nioqOPiJJCvbm9cu/U3q t9pAiS3lrJKQa2p+znrpXVucyEjX3x1NKbF5zuzZNk8rn+1ISqrnn+yngdrHeiWQ YqHQ/Vf6+xztA/1fZmRPMkP1wa25zN9Wy5y9Ls6BGBRf9HQredzsi7P9dwqClqNY oXro48408zrXpdxQ6uB6UVNEKQruVBskrPWYmGYKzT8/K8Qvicr/CfUUqgHREs2G Xb/+h+4zbr1IsdIOPia8Jw9VcdEFHBBcftGFFit0WaqDB39jq+RF6dO0UCUSndbC a3tkQI3fdWSxWHEPRPFykoUvdMxkhnVm34nSRpgPkS4+W9y0uu5NfASYNZz0AIIJ Ku19dM2uQghSk2rseGSTeuYUGimP8PQJPGSTAJyEOK8CmgzBokBc2Z22MKiCZDxR Ue5UPfwKIvoaKtE6mHEtpBwnyjTB4SX+wHHnyH7pK4YIJ75lkdy8l9XktXvClIZQ N8x3E77r+dGPqkIJbJeOrCC+Wr00B33xivdZa6snfF6+nQHGAe8D7FM86shRuAi0 7av02CJYogdYxlCdySg0HlbNQAk7pivPc8s= Extension name: 4154m48 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CFE2AA45447D8825

http://decryptor.cc/CFE2AA45447D8825

Extracted

Path

C:\bnkvk1u-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion bnkvk1u. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AC4E36F2A5D51DCF 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/AC4E36F2A5D51DCF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: nvtBtXgNz7f4hl+cRvGOJFckigi4v5n4d4mnkebUPdTl2s2OlcwTgzxHREX/ud4Z 5PRR+16CJnJqag8E31cPA6taLlbuBfxTTy3nDQ5BFBOxfYwHgGL0102xK7MaYzm7 Kn3siA0HP2bjvQJzs7ht7nYER1i7VLYnEAw3CSambMG8kbzn6etru0vXL9YvDf0A APmKWyWgMgMa7lM78RvjANP5eQ9O0tlg80JgCcn8ku7rqgaEjqjx7kCl6kv6J1sR G3Sr/Q9oY2bIpUElUVLAkLcZa7/aFd6cIH8CZ89VhvbQ9lORsQCj2xF1+HMve5SJ 15oRGyr5HPmBgsIi+0g5nPxVrb+EYqFQ7eOq7zzXdyJFxgakXH9bZDVnPa6mzg3j qDV0z2IWLZFhVdeDE8Chhwc188xzVR+6UTyHiNzqosxVFTXizSt8e+NAROD21YHT s7lgcstIGTDYh0NZjjVhIHZQwb3nWYDhDzDBo47uIGmLH6C24dd6qSc2uSnOila6 SyzeqbM0OqJEefdmD4wmq9Kt9hZhBSR5KK+jgEKi3r0lB3CQuFP1scVeQjuFJuHD IskI98gDKKMH2eMmwp9jz1P7dfegPJBfB3ehidn9xvgid7ftxhQBe6s0IZ7c7rmG ozez0nm36B/Zdk5pXbS6bLejx11umm/OjtxMmiR8iGcpOOh5VK5HgnVrOMQGgfgL oq1MDeoPYvcCS9BDun+xjHkXx20N4Grf8vzhfFeifCoL4sAuGidPP2XWtju86hom 7LJzRPdTmhfTncaj/EgxzShAi9MQFBoRq2VZ3YWZKJihsH06MengErTmMnQkcHM2 Bo5pCoaHzNvnlFSk2l9MiTWRimPXFdzsltwjToJ39seJoCvO/05KCuB8d4nh2/4I DQizCUIZ5XBJ9BdPezXHW+tjkSQ1PY80HUO6CLIjLK2bw9pYvtaV7oqAQEb5S7Gs 4AkmUTwbvSOONDA+zMOEPJeq3dPaxs2wJWGSDVyCDwfquU8L6Tgl1ClU2bQBeXjn Wi+Gq7yay9piDEDw9MuvdnNtI0A+X/w95cfFVrB0sWVcMerHLQ+V3JpjMcH0n7zK B2OjNR1q2jR7/4rR383W1bIAUNQuDNqxOhsNxfPlXa15PJz5F6xYnaYRyhsjs62S nFq+Od5HYa7DjN/xCvaBq9U6yHQdbl8lb09nMMTAN15GQXBG7jTTxrstoCkkopri HTN0A1yOr+jjZnBgemX2TNvvIbIfk47x0rQBy8oozvtW8GnKI7kk17jAUWVHN3C+ 5Q94Wm84PqEW7rbH6y82HNKJ Extension name: bnkvk1u ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AC4E36F2A5D51DCF

http://decryptor.cc/AC4E36F2A5D51DCF

Targets

    • Target

      8ddf92f666f9ee9f33d44e2d0180accdf97c50911dbec871a35f8e5e1424cc07

    • Size

      218KB

    • MD5

      5fb93b9a60f955ff9ee70f1555265b59

    • SHA1

      1a391bf6b975c152c6b70766820dacc7b91abaed

    • SHA256

      8ddf92f666f9ee9f33d44e2d0180accdf97c50911dbec871a35f8e5e1424cc07

    • SHA512

      4eddd9ba0600988b273606dc32bc8ffe86bfacfd12479e066273c38702b9ff074ff5acde0d6623ee28cd4e22783dd7a0183f8a362fb4fb8ac104bddb5cdb2c42

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks