General

  • Target

    7e46f081fa8d655a2f4746269727d3922295e67c1dedc164c3f5a131a0654872

  • Size

    143KB

  • Sample

    220124-b5yf2ahgap

  • MD5

    ef10fc95dd8b99fcd778658fcdd24253

  • SHA1

    0ed24171e09c924ce1b25351d52cfb0137c3b869

  • SHA256

    7e46f081fa8d655a2f4746269727d3922295e67c1dedc164c3f5a131a0654872

  • SHA512

    352ca0ea84c61d2030e2dc114e9bdf1a1e306c9f9a3d62e5e13644f170c9c36968b17201c496c0a12439dac56b50afb5b0aa9655de399144ac949aeae32abf98

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

Campaign

1428

C2

firstpaymentservices.com

krcove-zily.eu

softsproductkey.com

naturavetal.hr

corelifenutrition.com

leda-ukraine.com.ua

beaconhealthsystem.org

acomprarseguidores.com

extraordinaryoutdoors.com

mardenherefordshire-pc.gov.uk

stopilhan.com

triggi.de

anteniti.com

aunexis.ch

boosthybrid.com.au

bee4win.com

gadgetedges.com

tandartspraktijkheesch.nl

8449nohate.org

simoneblum.de

Attributes
  • net

    true

  • pid

    $2a$10$R6jfdY.02Ns/TL60z.A74O5Dw8.5EqXA63YzUP5X2NSO0l.4y0Gfa

  • prc

    excel

    mydesktopservice

    sqlwriter

    ocomm

    powerpnt

    oracle

    mydesktopqos

    ocautoupds

    ocssd

    encsvc

    mysqld_opt

    msaccess

    visio

    agntsvc

    winword

    sqlservr

    tbirdconfig

    wordpad

    xfssvccon

    msftesql

    firefoxconfig

    dbsnmp

    onenote

    thunderbird

    outlook

    isqlplussvc

    dbeng50

    mspub

    thebat64

    sqbcoreservice

    synctime

    sqlbrowser

    steam

    sqlagent

    infopath

    mysqld

    mysqld_nt

    thebat

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    vss

    mepocs

    veeam

    svc$

    backup

    sophos

    memtas

    sql

Extracted

Path

C:\df6a70-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion df6a70. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2B30950BECE1AAF9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2B30950BECE1AAF9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: khpoIg7wF8eLJEttIU78mX3SFZ32qjNLDbY8oB1eYsaeST96FGeca3cxwI7DL9Z5 RRuaTsviyM5reFoFxwSbeUdHaV7nBb0vimvBxvoTaVV41TYhOFiqs1WbwUdoFd+w UV0g/4k6+T/j2cbn1/3g7UeA08/kS26TTrkVdPksMY3Xh8Z4nM7/e6zs1H5JajCh uLdEVPcxvC8GlUa9sJPjc73U0FRd5f2Pf2pqCekxF33+YrWJqg0cBtvLLHycZf7u CSsbFr1cZvlcqW4LTdTUFuyWf+XGFOBuiHL0LaE9kWkoYEXSGCrUfvqwUeLLRucj j5f5oAx1N2J9aMYfq11cmV/Z+yOhfovM8kjIrrARDkrLmqkEFdutrob40mqAUemv cBkANId3QBcItq/d1ZJCCMxsjME8orF3bq6S2vMl2gQ8O3Sw89t8k1Mr9P2VRcLJ YUxRJQC6Or1xW8jWFBj3MwE3iCHvImq1+odz/JXpjHQXSkfUon2uG1WSHcvGKDWY eqNN9y/9hvGHji8MU+X9fkQHI8+QzykDttTSZa3Zn3L33lqBk5Pr+6f6eEEi30JX fCBN29CE07uiR/tLRFXcsEcuoLfB7oUrmIpBAq4fggwRMP2IVDZYzOD33dOR1XLi iHE1AKRytxivraJhl5+oeOxVbcx5uiPjPv0s2BCsHtwCDJH3TouMRxlnn6WKM8bS 6mgIEaSmSHYJ8LoWDZ6ZUz2QidXc0FlSxN9v5425nVmHYlWpKDf6CXE3mHtx7o/Y 2CKJdSJYgULzpxXMy0TUPXQu3ddX8LjldoIuRSGytFmGBXwewXZtS1M9ML2VRmJ6 w2KrkWBI37zLgnktHRla5lzXKifK1NyexCtNs9viqqmgxg0KjgMjNcTmPzEmDnqj PfoMC2XwlPaYiyzDeC/hZghgKXye8jVc5hezlYj+g3jOsH8s31Q8+a6dQkBBriAQ tcizs1w1iz5YC4nvFC/keHa9WujFTEFboOOeqJi6C0KjJ+nYyt/s0K7QsxtID0CM 2axMWLMDbEmeELvhAeiujaOKOWE+NFaPXd3kGS/oaMa8aw2cZFxcL5poCDrixgz2 VsGdXxzT7CzPPIDIE5jl10ScLeJjoXJFxihHV2/Qcvs/nmewZKS9VkNQugnqzZrk AVzNBSj3zVMCAUgG32UcwHwrHB1uecM9Iu5w0HnL7qMOSj+D7HWTOW9hjEWX6kQX gIxHAHTzl8xacdNemCrVD3PJ4elhkb04SmjpXp2/inr4BKjdb7upamlg/bSHwx3j lFObDwIVyiIAfVn8y/Yb/uSlCNM1/vdO Extension name: df6a70 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2B30950BECE1AAF9

http://decryptor.cc/2B30950BECE1AAF9

Extracted

Path

C:\mdx254a5jx-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion mdx254a5jx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/57675AE622876F02 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/57675AE622876F02 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ZFHejnxzocsUcBIEobIrY6K+WIh9VvXOVNdgytjtMmwBXXoS2wMHVZWgpG73WWqs i1vNtPgHNtBJfJc1ZO0BnEZuQs/WQhsFEFK8r2uNEo3+yQ5XmlSZgAWO2Lge4aHL fgUQgmoK5nYJbcWhOESfQpNVLvCLs5XBcoFKPBeD0J17hgFeNIibUH6sTonzX+JU MaER6XbeupMkpCkNvZnxoPmM4W1gTx9jLFVQv0igzY/RlxEbg8rtGEU+DCz+hoBH S2iBY0O2kyV9qS5NsLd92YJd5iItKZvh+12nYK007wSZGtpJwu6MfV0D+kTEyguS tA+yniwA/daFhISPKFatBS5qZehojLBjDFU6ZdD5xWwHnX+78zx+LQT8O0VPDFYF HKeDXGoKGyohx+dxgGSjLV3LvYvhr+RpRymhHfYpTs0TBjtpDkVovxmyjlm7uQND uR6XveFmreOjfUvzYKvpeQNXQOhYN51tz7Lqqrc15OLNlYsJtSOmym27rBFPi4Yw JShAz3QNeyYHhqS5bkKXFg2unAGGxdgqgHREPXXbxJm0sHp8/Av4F+LL3ExsncDG pecxVRVALKoKfaSvaGoxRxeZUft0aRegObUBGUWMsFd3UzpJOAiHz5jVAnMV+O/7 2PGT8csA5At9INaSjrWeg6aVIwgQLFhdBDUwE9/UDTpRHa9n3j+kXyaivFSaj4cM 6TzZ3aNdKruwE2J5gt40TX1Jgf7dudpv1JI3Ptc9MuIrTnecBsbMA3tVaaYWZBDS jAdCSA1di7Zfc+cdbBDt6E+4nvV5UG7AzAZBs5B0R7eOZ4Om+H+AjAkdhlcTb8lK CBMt3GokCoJqf37ELrF1QvsjyjdbiLOt3MZLxflvWsGpi4KBlZs+32ar8bIpRDF5 E8TV0LJ2vdkVGlBJai1cm2USkAo6BfT21NqY4f74u43YzJNfZNRw+QLS1JPCWGUz 4wiylfhClMP++iaQgzOIwKbyHYTtheOOzhvUG8Zaq4F1NwfsVQr9ax6wfkutrbUU bgV5KdVoJwZxzsVb7foQSzqeZRYEazzs+4pTkXKYYr1HFa/wR3ViZh/JUZEtA1IR SLwyh/vf9YuNH/4MuQDFKsLxgiyWoR5v2Ct4S2AEfbO+baHG/XtY2aJS9c75GFZ1 zZSeAtma9FTwgXBUGC37rqgTkWhJdfEpJ8rfIWcRzWvCJbuIA0xj4XuU6ta+vLS2 y8tfRTIOi9XveIdxAqkSiiG/lNBuUn1tb5i9JOwBLNX38Xm6vbmTZsA2q9lO9Imr tO2lGTS+hrbDcOioiXd2KjxpSak5LKA9 Extension name: mdx254a5jx ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/57675AE622876F02

http://decryptor.cc/57675AE622876F02

Targets

    • Target

      7e46f081fa8d655a2f4746269727d3922295e67c1dedc164c3f5a131a0654872

    • Size

      143KB

    • MD5

      ef10fc95dd8b99fcd778658fcdd24253

    • SHA1

      0ed24171e09c924ce1b25351d52cfb0137c3b869

    • SHA256

      7e46f081fa8d655a2f4746269727d3922295e67c1dedc164c3f5a131a0654872

    • SHA512

      352ca0ea84c61d2030e2dc114e9bdf1a1e306c9f9a3d62e5e13644f170c9c36968b17201c496c0a12439dac56b50afb5b0aa9655de399144ac949aeae32abf98

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks