General

  • Target

    755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783

  • Size

    155KB

  • Sample

    220124-b8gmpahgfm

  • MD5

    5aeb6c929b8f95fafd895c181ca47c1e

  • SHA1

    6b3edfc8dbfb1c7726b38e62a01e209b670e6f6f

  • SHA256

    755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783

  • SHA512

    655d18424864e0a997be068b12b8d655a2e3c76218ef2dcd54b0d4191273cb6e5be09fbc076be2dff19f068fb24ed703b6a3695e0edc0ee99fe53e9fb33588fa

Malware Config

Extracted

Path

C:\n6r5q-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension n6r5q. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BE3F02C434D9EAD0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BE3F02C434D9EAD0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 4keIhjyBjMDDNet7TpbwYOG0UrbKXVY5+xuOuMNfTZRZeUOrFwCa0I6MzIFyMSRR h6MIcb8sLG12H6ltU7cq4cRzD/WL23mZUDNNjf/a3Q1ji18NVLbj74Kh/uEcgE48 4RTyg7TgrvMt/EM/b0KW1VFrOm/1f3PN9VbSwBUX4sFWyzOCFbVJmqaK0R0b62wx zJcTPY10cFpCFDIE8DcCgx/we+MIQJu88/NNrPdN5RGqef+HjV+m+JhJA1l8HFz+ DMrQ0qihjrM55T6OwMuE4quuQRKsnlj3biHZxqKcbQ1LqPoX5FVMTn6yrhwRn+Vd HUnYMVSgQrvQosDpdBAZLsQyqwzLWE2sP5NmLYJM4SBx4brs4KqA3Xv8h8B/Zz3y q8Js03zDoTDaJKoGlHWCU7EMGe+43qug3uBHDU1c9OR7Tdn8ek5NNH6GedEmkc3t YJ9fTRlda4c6yX4sh5NjiJ48r9yHjh9RIUuPKTmKcBW+tAY3UG+Srr3bPmVKTNUW qr33ZjzIBgWlr9IcdkJi04GmkWHNZxNEvjGjkvDTBoe/N5P0hR156ATcB1cbs8Nh St1CMXYq71J9OHTGUGcXpG+VH71BqE1YsP3tXZgzZESWey3x0Wn+on88JwXjZGbH JuU54cKThS7gHRlIlYFjDkAWnqTfnVz5/rQv8a+OJrSPjEfx006FUML9hgip61y8 H/4dH09YQ2tK9Tar8nVRFWx9eml5D3Qyqax2Yki8X6/qRH0ALgp8+RuuW5Sm0bcb hKXMrkWmQIocmI7k8GhSNN7FEAfyTAZqZCT6ZOUZ8ZGmde6idIHY49OpVFdHL01h 1qw91eOCr3tfXTupnXrO4mEFBJvUpyUoRwQlofw3KgUR9CDt4VQLzTVuO9KH+LOL 3nGeOaGQjOsHsNOIBy02Dq3VkUsN7DdslD7/edlHl19iPE6E1auZTBJ97CBpoldc 90DY2O9UJ9LaKnoDGD1QbKwA31MIMyXu1KMpQ6jw9nOP0UJrKrwhbk1NOjUGcyQW VE8o+QDZyMMs0nFRAMGEaacGHM/LUkHXoS9tEGF5k+QP0VKwSHtYfUDrJJc9/l8g QFJ8TwXzLOu+mHIyH7cFzCRx7BXlj4HsYpnAEy8Xpr6ALFNBy1U9RMf7CHfrDgw+ 32X3o4pmNlHQuP7lZBuFRLxHVttN7/h9mY4kXMhrp8vtvWy4oifx7RWKM5JUCqiP aOfz/SdPBGCOVkjxyMI7sUV9kwQWvm5fib0rdS4u1YS6+XhzFXUDEvs1IrctFacX 72i/xJvkO1aiTw8lyUbPYncX1lRl/w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BE3F02C434D9EAD0

http://decryptor.cc/BE3F02C434D9EAD0

Extracted

Family

sodinokibi

Botnet

$2a$10$XBYdz5uJZTckimoLq1qY5.eGDrSYmjkMdaoUedYguG3PvckgIWWde

Campaign

4117

C2

miraclediet.fun

austinlchurch.com

i-trust.dk

cheminpsy.fr

aselbermachen.com

servicegsm.net

todocaracoles.com

travelffeine.com

katketytaanet.fi

lloydconstruction.com

uranus.nl

rhinosfootballacademy.com

notmissingout.com

cerebralforce.net

higadograsoweb.com

ncid.bc.ca

edv-live.de

pierrehale.com

grupocarvalhoerodrigues.com.br

yamalevents.com

Attributes
  • net

    true

  • pid

    $2a$10$XBYdz5uJZTckimoLq1qY5.eGDrSYmjkMdaoUedYguG3PvckgIWWde

  • prc

    msaccess

    dbeng50

    tbirdconfig

    infopath

    synctime

    encsvc

    thebat

    sqbcoreservice

    oracle

    onenote

    wordpad

    mspub

    thunderbird

    steam

    mydesktopqos

    ocomm

    dbsnmp

    excel

    sql

    winword

    xfssvccon

    firefox

    mydesktopservice

    ocssd

    ocautoupds

    outlook

    agntsvc

    isqlplussvc

    visio

    powerpnt

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4117

  • svc

    mepocs

    memtas

    sql

    vss

    backup

    sophos

    svc$

    veeam

Extracted

Path

C:\48qi2i4q0f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 48qi2i4q0f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DA2C16CB244F2C72 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DA2C16CB244F2C72 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7JFjxXz349+x4PFU2xbq4fy2gQpgtHgC4Vrp4UPGfcLJ0gc74CKGATEWdG+a6VBo cEgAYDGFQpGX4XyAYO3oINCerbaSbTDMrdE0AXHRAk1vGmcJ0k5EmzwMsdP4dJTS dAhx9Sfv6Ss3A/5lAlXTvtCcfS4sfLeLcxuwFLJ7qLRX7qAk8y03UNKDHNW2NwXd 8f8fe/R9rBMlm/9TAcHVFUpeDIHa38IA2ch+cyVoDL8GwYJZ3zpDqKCY6KiNXHNa MMFetV/6WjDlUo1rDQ8K7wLIADqstkifzoM/UADW5iEcEBT+wwer9ooZyQFpK6L3 pquQhgYGWVyGpbZ7FwZAg6fZJPm5g7MUcNGr1t09dt0l1FFfxpP5ZDb6qSSvg0Xz 3XW51KTVskmMk7m7exD3gSi4uI0X7i/hdpEy2PuqGWdxeOigyyzku3XM/CvylQ2t PT3D0RRFDa8ZsFq9JU6hFk1yMuq7cJtiIvWg0KMIlA7Hu0EpOlD0yndB7p7NBiEv y86QwnK+ftAfJ+RiLoqLJMjlxENtB2R/vHg+fz0dIVP6cuKEJZFbpjE9ee7fPgAx INpTPI0v4MNXlEDUDHt/4RiyCk3ByOXwmY2FdhD3pwjJOTST/zcr/cGuMazf1XlN 0A9ixJfhrL1ICTDklNPOqLjw+Lb4ES7DEgLXu7ReLJ3Ej6rsb/OTZMXo1UielECq sqx86pAihQXsumvt0chvf+IoUeRgoO8h06gXRnNLJWCQm7a9jicT/5+P9FPjKZXx EAhwgnI0kIFd0+PZmKt8tvPvj+2sA1CzxDRye+uu3MqAUx5MKYKjJnzjzxHQqO1w qCVlg3KJaC/ZsJEs30kxz2tnqnPr8vGQduRea337tim04OHKMi4HRs9jzijdTm1o bwsPAWb3O73MRKJDnvKUZAbF/xUPI+VHnei2ry7dO0CdFzx7zf6gUza7wRmZMh9n DGbip4GJAPjI8HwwNz1eo8yHoW4Mow2+7R33jtzzxiKzlk4G5KTm7lonOPBCU/Xy oi5ARbW/e8B8y6wt64Na8bUhK0HIRpWzl3SLV3z7+qZi7jBqERiHDZfO+O7knorw uiUt7prGbMEVYNwtm5fe/d9sMNmICgDLC90mO9tDfALHDjYxwS8pO0gfxR73aGgm YylxO99mClU+T3jHXWII0g9vnnSLk86CsUYqkOHr8DaKwVnkWuilEL6+l0Ep8BnX xi7qXbxf5DjKC2YYxKqLH72S2F85z1vXI+IWTvV1amWUBe0oxYr+ZIKiLLvvALEd zG34CFtz4QCzVB4RqednBtvD9w7gKXYH ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DA2C16CB244F2C72

http://decryptor.cc/DA2C16CB244F2C72

Targets

    • Target

      755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783

    • Size

      155KB

    • MD5

      5aeb6c929b8f95fafd895c181ca47c1e

    • SHA1

      6b3edfc8dbfb1c7726b38e62a01e209b670e6f6f

    • SHA256

      755a0472f68988a0cfd0601131cc3531d64f32605b60e7a4294419c5fceb8783

    • SHA512

      655d18424864e0a997be068b12b8d655a2e3c76218ef2dcd54b0d4191273cb6e5be09fbc076be2dff19f068fb24ed703b6a3695e0edc0ee99fe53e9fb33588fa

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks