General

  • Target

    6f4da4d2ffa8f6d304131abe904252b8525f41869995eda3a8053de5ba550b27

  • Size

    114KB

  • Sample

    220124-b9yycshhd3

  • MD5

    eaa5485420a36a3da247d4dba0da798e

  • SHA1

    d4bdf4f94f76705af01274cc59716428599d5efe

  • SHA256

    6f4da4d2ffa8f6d304131abe904252b8525f41869995eda3a8053de5ba550b27

  • SHA512

    8dec4c36541fca7ae46499df433a2a383708088c52d759530e7c18269592ac5cfb6a2866bdfffe7635ed936c92ad06d94f763fc4f7865a123a1ac993dec3d86f

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$Oqg.VG4laR4KX3YK7EmequRjvllk893EIXKAWFJ5iBefRE17FRZM.

Campaign

1428

C2

karacaoglu.nl

songunceliptv.com

ungsvenskarna.se

rosavalamedahr.com

huehnerauge-entfernen.de

dubnew.com

personalenhancementcenter.com

synlab.lt

ladelirante.fr

ogdenvision.com

shonacox.com

tenacitytenfold.com

zenderthelender.com

iyengaryogacharlotte.com

d1franchise.com

c2e-poitiers.com

global-kids.info

penco.ie

centuryrs.com

oneheartwarriors.at

Attributes
  • net

    true

  • pid

    $2a$10$Oqg.VG4laR4KX3YK7EmequRjvllk893EIXKAWFJ5iBefRE17FRZM.

  • prc

    thebat64

    synctime

    mysqld_opt

    msaccess

    ocomm

    onenote

    wordpad

    outlook

    powerpnt

    oracle

    infopath

    mspub

    isqlplussvc

    mydesktopservice

    mydesktopqos

    xfssvccon

    mysqld_nt

    winword

    excel

    sqlagent

    ocssd

    visio

    steam

    firefoxconfig

    dbsnmp

    sqlservr

    sqlwriter

    thebat

    encsvc

    thunderbird

    ocautoupds

    mysqld

    msftesql

    tbirdconfig

    agntsvc

    dbeng50

    sqbcoreservice

    sqlbrowser

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    backup

    mepocs

    memtas

    svc$

    vss

    sophos

    sql

    veeam

Extracted

Path

C:\drq2wo6hq5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion drq2wo6hq5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8929A349BC2E55C4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8929A349BC2E55C4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mBd38NB7JBiKuAG2dBaw3NWsBbIiqcyidHT0wzil8sOHAhDUxL+fpxu67519ze6X EvSQA6aQTDoLXaHaPpw+zOtHpG9hfWuXEJN/WqPep+y+C7+0GheLZBOyTpe+L6nh J+gg+k96dSFZUcq3NyWErvhWzWvVkf6yCXdPXa5aQCcyfWRysqSs0ytNLlRcJtdc m6KMa19hfF45mGkECx134K8vX27dwH57adYRsTaUCT9IdDpUDqq2beQVDTX03tIh OxIQcVWmTQT+thAL5MeaAtLFmrP+ic3BtZ4BzGk5rhKsdrq7dDrQMJ4ppuxJUEFg ycF5pE+JyGrAJEmQBbBJmmkSm8GQVnDK/OyUa+muxtvKim+AmMWebPrs0JBr6FxO //Ehd5A2DF/S5wjmy0m7FXg55uxqnpRCUkDIupHWctwNO+iANsmoGMdxCSHd5sRJ Nb80GZfoH1oDsQ/uoh2yRskpA8DZfbjLYpLPUq9FobzZmFrBQySreaREoUdGEM3T 85VOm+yjrtxjVcg4BnsTOk02ltL0SvQFoPaj8VkPwEaxnyqvaGUBtNemfsgOEXyR pEg6PCtoErn5TUyeFpdIOGDpU1OGdbKwvPbcvClznWg2TnS4r5FPaaF1ZbOHVpIW x+UcSRTyvNXrK8nV2lljM62U/uhz2fvJFyldMPme7+B75pT+SnlczxtpVf7hRoNT GpBcWmYCTN9afZX4yYitHIrSVa2qFx81FXlwqWjUldeVTOQr+SaTa9dM0h2yDO+i yKseRkwe1Nz9lB0y2uUXMwoxgmfNw0lVteOlIEymyqKQHhdnxwrRKi/dj55n01rU xTsqmBTB+OmH72qKDSjJvVnuHVgla+APCtu4e92H6HGT6Dz5JNxEJ7iYoNI19sHF VmhOD1WYnB1lE+qJwnN3BZWwF8/vc2vo6+sNtZGInFUeiFT2VOZgD8/c+ZuV/upy DuhWOY3+k0lXz1G5nBcwjGXY387cnKAnaR0DpivP8lqMlXOTZyyrcj3GevOscQnx 59k4gFbcAn59qhHFnV+rHOwwsP4966skIR17w+H3yggNDQ+PUt/9rfvzucW30Uax HNKXlYqngZbMM6frGZAyDietdaBidLs2tfSlsmteHqiCfOEGhqDWg/rwQD3CS69/ /iiBbutnacAnvlO49I5n1n/RSdUbo5sP2Ndx/iQe2FKMyTHiMuHG5ytZO8CkI+Nw BhHOyoIUdE0UmNCoiQQZaFjr7KYRck0pdAGBA+k9myIoxKHeTmeyXjcvhMLUu3pa HH719HrTJrwuKowOtxQxJL14LPSniQ6uDm3ecwcY9CQ= Extension name: drq2wo6hq5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8929A349BC2E55C4

http://decryptor.cc/8929A349BC2E55C4

Extracted

Path

C:\m0108uhru-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion m0108uhru. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D6F4B688CE576F48 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D6F4B688CE576F48 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: GKDZxxlibv2JEls0v48kNlG+7a8Zpq8G32MIl9A6hF8sVryurcOp5QGbEhqteQoJ o08EF0rL+K2sczOcCcIh40kN9bQ416L13uRLbR5Ueij2Rx5obhOY4O6WYFtTqxQD SWQK3Dv8ZdAgAeFYj+oGpzKRIVYKarP6gs6zgvDmzlMTynOWiO1WGRBj7H8UJgG6 zFsdYKgIOcPpy16kGp5suIobKYKXTjyDYxBH/Q524wwHhlEU1p7IproZthZKWgrd wqhiM0ojiy4OHuzb0O2ANtS1qPUoQxnT1qRQfwRzg0mq7qrntOYY0qVCbefyAS8A sdKNuGfMtKnTHpIRYadDfuxouF4YaXy06g9DOijnDlsbVTBH3Pb6+BpIuKxr2LMj YqDHZ/f/M/tkSxPvVzdwet0XfNoylvgW5DOJkyvt+4UM+tIN3cncJfT8hyxT0RQu WtWLfLEIy9INLqzEhRVGv9E8IXgtti0OMdRKOwYoXX5W9Cg/zO6Mz0W+fu/fM28O nMWREl6SBwwuvycHUnuRQBQH0R2tFCCAotXd4/mEmf+fIdcmZG4t5hiEo6/z+kna C2uKIiSiXHoUvhOdY2oXwTp3xubKZEYZls+Xn9zOw2G9ypcW3M7+NmvGRRxbnva0 rR/PbitfDPcjbKKPbybs94CuUQ2QI/AguF8nJqWOCvTmX0cOtivAFqdXmoptNiK0 dieeUQH6/GfoouUyUFaTziifIm+90nlo3ajgZyxQHUAAtNDJGtAFCUWyC4IpiM0Q BHh7QC+aajdyp+o7x9IaSGFnUrhWWdQwO1fS2F7H8ezB+dBiihik2NKosQC19ntJ adqmGPXL4RRK7Kq0wFnLvJXotomvFTXDdozIcz+WqDmCu1Oq28dbuGj/GRh4Cfzo 0yp8zaJbis6rjaKpKL8MxmlZ+Pm5PKNKT4ouEDSoNyLiH7Sbh0o38tiZwur7eBew IRtoSkMvJNKRBjP0tMpdRqopmYHhTIQamFE8CMF4xI3H59bWKbxOKs9G6vslMJxx 9l8NeuAii2BZnUxetAfWc6IRA7NrrYfbOqLw4AeawNkPxg/xbnOXME7FmspJqc/c oCvOLhclOJTiR9RiYE80YY9C2BnnKQreVpq69Kc3bt57HWdMVlTVWquzteqb4Qkx LCXwBG5GYft+D8dE7jXDmeKsIEVimXVVRZYQXBI/T5kqVX3MAyRWLYHo9nB6sdor b0BZuQLnV68iB7uGEPu9Mw/e8oKpM6nBO8yjjNSzYFo3p7CbNjoghmYCJ4h3O/nn /iwWymXdT6sQ0Qy5N0q5QAg4skckvA== Extension name: m0108uhru ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D6F4B688CE576F48

http://decryptor.cc/D6F4B688CE576F48

Targets

    • Target

      6f4da4d2ffa8f6d304131abe904252b8525f41869995eda3a8053de5ba550b27

    • Size

      114KB

    • MD5

      eaa5485420a36a3da247d4dba0da798e

    • SHA1

      d4bdf4f94f76705af01274cc59716428599d5efe

    • SHA256

      6f4da4d2ffa8f6d304131abe904252b8525f41869995eda3a8053de5ba550b27

    • SHA512

      8dec4c36541fca7ae46499df433a2a383708088c52d759530e7c18269592ac5cfb6a2866bdfffe7635ed936c92ad06d94f763fc4f7865a123a1ac993dec3d86f

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks