General

  • Target

    7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829

  • Size

    160KB

  • Sample

    220124-b6nm8ahgg7

  • MD5

    fac2cf669daebaf56f2fd4b3e0da10c0

  • SHA1

    778bef878540c39021b50942faaebf9b473d4918

  • SHA256

    7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829

  • SHA512

    0f8688c5f66c99e6951886c34123c5a8882e877fffd82b150810d8664784ea26e445e5dd9b93ed38bd2aff6506df2466286d0500682b6d5ebc4df12c0d0b5c92

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

100

C2

matthieupetel.fr

irizar.com

rivermusic.nl

voetbalhoogeveen.nl

smartworkplaza.com

pxsrl.it

marmarabasin.com

anleggsregisteret.no

pajagus.fr

atma.nl

weddingceremonieswithtim.com

teamsegeln.ch

iron-mine.ru

schulz-moelln.de

deduktia.fi

artcase.pl

handyman-silkeborg.dk

alpesiberie.com

jaaphoekzema.nl

afbudsrejserallinclusive.dk

Attributes
  • net

    true

  • pid

    19

  • prc

    thunderbird.exe

    isqlplussvc.exe

    synctime.exe

    sqbcoreservice.exe

    agntsvc.exe

    dbeng50.exe

    powerpnt.exe

    steam.exe

    tbirdconfig.exe

    mydesktopqos.exe

    dbsnmp.exe

    mysqld_opt.exe

    sqlwriter.exe

    encsvc.exe

    ocomm.exe

    mspub.exe

    sqlbrowser.exe

    msftesql.exe

    mysqld.exe

    onenote.exe

    ocssd.exe

    firefoxconfig.exe

    xfssvccon.exe

    ocautoupds.exe

    outlook.exe

    sqlagent.exe

    thebat64.exe

    mydesktopservice.exe

    thebat.exe

    infopath.exe

    winword.exe

    wordpad.exe

    excel.exe

    visio.exe

    oracle.exe

    mysqld_nt.exe

    msaccess.exe

    sqlservr.exe

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    100

Extracted

Path

C:\25y360tr6d-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 25y360tr6d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F7C42DCFA860A65D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F7C42DCFA860A65D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XKw5QKxxxn/y8JuylYS2ASuUvlh10p/HzXwone8btZW0kua3o7Zyjf9wS06nl8ZM WSUQLrTFozvBCCye8TnTKxvxM23dogbTM1K6ytP8IqbQlgZYxJaWxpNvdsO6zCyN f1DS/MjL3sBrLy26LlupDC0XFFCzVHKDfoj/8p2cir7tTxO2kCyO9ESBjs6b1xKH Tu8Ur954y93ZY6wddjUfV5pO+9034+0XH8BBMANR0zFhuNwIb0AHe4VloeCLOD5l nXMiw07Z9gFniEWx7eRqxQ7y7nmKoazDAchnzCcSUR+6BBqKQy4Xlr1/0XtJkPP4 +ahpIHqH/CL5B6HnA1+wWX2iJkPn2GQZBQJJzoh+tpEu9Xk327hIEsaJChKKRnXh ypNilaNcrKkgSFkAT9JbXnFqRddBOprjGi4uarKZiFP99HO/bjc2VsyzBqk9oa06 uQNqRRFw7t1H0o8Znr2L/VLl9X8gzkngy4OJxzef84gMpalJejwxh4u8ytgqcxN+ +KViSTY0ttrRv9vah7cEol+vIQq7tJQA7KGtYmqTSbOFBwZc4ExLXYEjqGDuPoLE X6diyRgcEtepE1svhB9CFs2zKFOA8x9hCuiIiE3lIdJ20Vgmz52u7gpwc8pWIb41 FVNwQf/ef+2w3q8WOpGx8Jh5kajkhdbExshmhJ0hzrtlUZw6nhYuEM7YUgYdJZT7 vKeBIDM298qD5RlnNAd2YfKpUpGBYphKFit8W233wTA4d8oZkhoXILCyeocpHyBf sjvRBlZXRJrr2PZdyOuFFzQs2QKbBpOPTFxRZCWLsw2c3XXt/3rhnapNL8anWOJs 9AG67w0FeKZ3eu5guw/EM/dooLLAsw9RWKurEBC+RerbdGlJRKjzlnCAat1eKyIN H9Fx9FxAcEmpqfZ0qcGt/22QjMAH3lhKNZIzYFj1YV8XJaLyoWmwSgX9Wphy5ReM /SDaoX5K7hqGyyKIRF2WUuAmufLM4rOrlOuAzw/RCjEej3o8tD08BgUjglpCR7i6 UoHCsEvMvoer3C7Rj1dDWIYY76mflISC8soArao/SymS8fxqk7iAFWlz7tpYJ5Mc m4UW73JkTjk7bYyAqOvtr+GhW0ghVjgmX9yacDoy49+Lyz6bQ3WlkkSneWHztlL8 7wynFNBB4/J99A== Extension name: 25y360tr6d ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F7C42DCFA860A65D

http://decryptor.top/F7C42DCFA860A65D

Extracted

Path

C:\cmzln986u-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion cmzln986u. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/37C123AE73F31004 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/37C123AE73F31004 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ucwpbdkT3TVcDODsDEVLNqnbvmQJnUR+nCpZ4EI4YDdSK4lC7Qeik2SLisE8GfVZ 3tejS3i1zy3bFDsaq2c56tn6e42MzrvzsgZk+vVHzVElU+4FhG7cvMJDYRB7l21S zB3CaZJr/EKFcfOs/zyWr+qNb7P4ltTvI4KVUB/h7TdOJNxxgcnc9ZGKQ7vWa3oo xwd6jLfgdZk/5xtdJMjBo6vVBHwIPckVjorDkzeQ2i3EjwDJrgG59I1cUTaL1m5L p107qjx+SHzAO2ql0JkqEc6LKC0JnPvKiVN8ZcTvWpehLLbC6TVH8gN6bJ8s7J0I eyq+/6hUu11dttKUtb6D33c3lc0Onq5QHy4jDoRLevUw17g9/jW3/ThoVAw6NfeH cHdGhRttHfqDu2iYeZV5Y5ZE1ZihRpxWLiLThXqJvvrcwl9O2KV8CGLbD8VHJdP8 2k4D9sfSz8RZcO0b8S7HIUZE1I2qNXwsI0b8iRUjtkQbinOpqK2LB+nvmoAaWXYB 9FF3YydsNEmJMvtcrKlATuvoB1Asm2sqaMg3sGriJLxbYQcnpZ6WPSqap0YQRzxn 0uc2f9DeWXOgQ9Nkl/7aFWEna6wtpOh/5YmSiH/N0iPGwBXsmUuSUKLQniHUksFI veAqBScedgTeWGnGyheSndYNVFZwSURcILaCP6oOXVo9xQhA0gwwKaNsbb7yhiT6 vGaMbvaVmyhgMaSVddNMLPMU3owGWmkIzETh1kohNPUyvf+f9fqAQGB3RwPVg07k esZQj2DAxlIOvbLqxww1b3zzU5IVhQK6BARvtZCX7akq1OrE+iZI/sbk7OYptc// 87a99Z+Ct1CChuu7tsjmQNBkxhG08nPKw2DWSaz2Ty2tKNY1YrmN97mRezUFVKXT WBY3JDdhoszoR29N4wBeiDwiRIGLdtV+e4wOJaCrIcnxvHxf7hKF3Ge7R0FYaVTf ke3PQbBVVDWJnM8dOv/jN8Y4Me1c9V4zvTCAanjQQ7JCyFkUSKbz/HTLSQRq6JYo 88ykIeuvzGy4MpNhZXnwwkN1UuRAEzgDn1bD2Qf3UCKvCxMDXvwqRaR20Ywfq6Fk DfCh3E5Hsx4R1s3lggs0OHKfZ4WgOI9jHvLpeH3j1AgPPYsEAQAbdn3tuKrQaYVI Extension name: cmzln986u ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/37C123AE73F31004

http://decryptor.top/37C123AE73F31004

Targets

    • Target

      7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829

    • Size

      160KB

    • MD5

      fac2cf669daebaf56f2fd4b3e0da10c0

    • SHA1

      778bef878540c39021b50942faaebf9b473d4918

    • SHA256

      7bafd5de1b6724962ab920f71031978a101055f061ae3cc21db8bb9fa64c5829

    • SHA512

      0f8688c5f66c99e6951886c34123c5a8882e877fffd82b150810d8664784ea26e445e5dd9b93ed38bd2aff6506df2466286d0500682b6d5ebc4df12c0d0b5c92

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Tasks