General

  • Target

    d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b

  • Size

    114KB

  • Sample

    220124-ba41bshbb7

  • MD5

    a74b5a306c88a8eac8f5ba0bb502fae0

  • SHA1

    609f85fb3400e7ba88df11df2a9b965680a500fe

  • SHA256

    d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b

  • SHA512

    be4ad74324e807fa51e6bae936f0a19abf44b4a68fb6a47032a84748e7a3d9abcfa6b20f41a808019a7fa40d5ea8c7cb6a8221eb625241ce7a0bbb314c8f8cc2

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$hxAi09uLLkgMEZLo5jvS4.5zq5WXIShOO56pANaN7XlerdpljTPeK

Campaign

3989

C2

spargel-kochen.de

blewback.com

eraorastudio.com

vanswigchemdesign.com

naswrrg.org

jeanlouissibomana.com

art2gointerieurprojecten.nl

pasvenska.se

advokathuset.dk

amylendscrestview.com

sloverse.com

zewatchers.com

1kbk.com.ua

offroadbeasts.com

berliner-versicherungsvergleich.de

marcuswhitten.site

zonamovie21.net

verytycs.com

i-arslan.de

wychowanieprzedszkolne.pl

Attributes
  • net

    true

  • pid

    $2a$10$hxAi09uLLkgMEZLo5jvS4.5zq5WXIShOO56pANaN7XlerdpljTPeK

  • prc

    agntsvc

    mydesktopservice

    dbeng50

    visio

    thebat

    isqlplussvc

    infopath

    mydesktopqos

    winword

    encsvc

    synctime

    mspub

    onenote

    xfssvccon

    outlook

    powerpnt

    sqbcoreservice

    wordpad

    sql

    thunderbird

    ocautoupds

    tbirdconfig

    dbsnmp

    ocomm

    firefox

    steam

    excel

    msaccess

    oracle

    ocssd

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3989

  • svc

    svc$

    mepocs

    backup

    vss

    memtas

    sql

    veeam

    sophos

Extracted

Path

C:\x8y4648-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension x8y4648. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/081C43FD3A3B5CD0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/081C43FD3A3B5CD0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: BKrGlxDeQsctLhRwGPtZx4/gJNRIqQer/8z8xpslmHClN3cY9WXN80U0Qycv4UmA OEvXw/uIhrx1tEj/3/UYQ+WIjSnlaZbKRLLI03k6il8WFnWl6/2JjXoGu2FRj8Ni zx+cdCAuMAXp9DQRccmhkEB+MnbKOVQ37o3/VwaVhnLaMM6fPMZT/nWURVFeQRwJ RGm8+e7DcywS8twtRmniTyHHNz4Vvzw1BRl8Xpr/3X9xtxYFUZZ9ge8g1zZqWlBU Q2eaJ302ASvbpN3HNwesaKfoCxoGy2vAg90Zz9+Ur8gjoYmy0GrVM4wTVH/BrEBA c6K+vEuDB2v9HdsibU2BgApyGWr/IAOqIpFRouR6DlQv2+XQ1Hm8U1Z90ato3Xbb iZz79gL8/e6+wkDtW0wlB0EjM43iIsXyP0e3h+FOXZuqV3EKntnK2QbmzPKd9B5k ldYTD5PUA0R7b3Nj+Cij11lbuCpNJiQNHun7KShER7BQ8uZo6822Hg4O3HW6SyXT sLcAcOk2Hp7kHk9rQoYDjj8qCxT2vcVhZr2xCBYCiZ5c+IurW/zzK3ZxyFFUDOY5 L5dKutUgaatYLlMqBM5J9JXPlMI1QyFVFaUnJo3Zlvv4/MAP9TNKDi7DpRPu4YUh qMWAQ3/H6mW3T0SGmyIwd3mSpDzzT3c1jNXqpyIlt1BFbYSkQVhJsQuXEu1c4ZMC +/+3QGxYpu6ndurmp2bmRZ9NijNlC/V6OufAm590G9+Xe3P7TvchJ6pimcctLkXx /BvIe7aGw5Bta8pOc69aITCPOpqic8168MYMv52dxg/Y2oDDadAWAFR99AzhgJUa JoU4RvmZ9x0M1G4zH9wNy01djDds7qrMkNIahIO9Dbaxg/Z1bjW1eydZC8NN0nCi TOHEdriGt9VWgleFFpBCvS9zP/bxJ9vS2qXiJkQ1p7pvI43C4VpLlYikLp+Nenq0 iUL/Ky9MxjGHB+8dQ7S1yAfIH+uQDX5ayQH/9ZNa4oV77FP7B7GQrGCSUuoYo5Hf hiSVICyd3IMd3bWS/1nRPsOeGzdDISkreTdth62CkKFl1PkMXSnhUzHWwAwrrbSC twUtvCzSNlMoQ0rt+ss5XJ5aydWfhAhQD/m4R1IHM2H2Z3WEDA+/n9VbO54Xm1Zx xzMdflMcccRolEBgpwrV1HGiXf1vdX5MRdGa4BQZ4V38nTUnFh6/NgsrBs4jgusl W9IYpixlQ8zGvNqtTZdIe8xbhUVEowXiv1z/EsZjQcozb4d3NiacR7TlyNrGCi6g T6ia+uZXJK89b5QvsgOO6AExlagYEsD0LrA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/081C43FD3A3B5CD0

http://decryptor.cc/081C43FD3A3B5CD0

Extracted

Path

C:\6lv6bup1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6lv6bup1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0FC26EB6BDF750EC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0FC26EB6BDF750EC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: j4AwYFcEacyRgFuSrWuC+2bcVmZvsuenaP6SswFIo9a/r5MYKTOyFRSpI8BlmlP1 SKtdeeNULtPUz67zD+OGtl+ni5+E9uF17+laamG1QuMIK0HuagY66wqD4zfhQB8Z HdFipf+yHFUx4HSX/DPCGgEpf25k/aEtopvPeZZtebY1YjSqI8PsJ0qqNT0eoqKm QrZNskf2sh/ctX0PzlaTCNHxDBlUOGxsnLLYcFlY8DcSQk3ESRsHfp8MqfeKHlQR 6zNmqMJvTrYIk+YQn1hExs1yEsJL9M9WRVgCTZGLbYxf6Vw5qb1A7Otc1qI7l/1W Kl5A0EDb+6qrt9f8dTl2+dQNBCH+bXEX+HOTOzxG5R9O4CC1J0JgC1zM2Bsv0otG 2FpBM4FKy6lNj39iCQZyS3v190ndFZG3GbB5JzGAMkbz0pxrPVLyNl+aTfeCleA/ x27yB+27OUzHeC9cn22i3t5WtV0h1mXdCxvAeaxEjLizIbkshyMdQtQ08RIPHspy 0WQJiZ6LnMsAtIOxUiCHBNRehG8qT/X6qt48D0gRfQRYHeJLCdEIgHsaLuA9A9XR I70M1hP8COJO5Oqyu5c7lL8eXWiwGyopv9/qKRX4GaTP3XBbNpG8dPfAUh/9DsGr RWEOOGCdmSCtUXGSPhzqlkK2WXFbFJoeUw9JV8i/FGEBQ4JaGh+E+lmjr3bPMtm8 5rrfWhHaXRkBX39f8BWciyJ/iPS0ZxyEOx1pSfslRQVj4Q1ChOvJkVBaJXxzwSvL Cba+SSOpSNEfwRhiWUkBEGYH98Uf/86MAsPsBmTPp8Hnaoe3Kf2bMheXEM8NgXyZ b8Pd5ZDCeJVNxPFtjLWDkpPDI7qKjQOwz4YBM0H4DxdEAzhcmy2hwD+/WI3RHJ/K PV2nkAaXwa86YRDA36Mye6BX6S4lVjJEYNFcR0I5nK//ltLBaS0M9nAqAwiYD3oj H6zuxOXbBQVBw5Lln6ghgftQWq8BLTGu1+dqXoBHMMwKohQDXdh/wJq4cudvcuIT jYi02Y2wQdBVvM91mTi3tBPTZm2/o6ME70tysJwKL5QZMZnIkbzpshTs+EPhhffk 2B4vaoVD1pJE+iT5bUBUS4MszzWNUPpkqzGjG/T7YbfooMcBAVX1AEwz8FIU4H8T HM/KFMowmUVFaEIyQCXlWQqvB+BpuhP88/1a6FqgMVOXm5j/AxIgmAEKZtqCZiZn LwWe5p9Yxm4cqJiAQ6WqmhcIOocPptWH7UhhLGxWjeKGOw0SpK8tPE+8dgNJwzMv KXt8Iv8u+AGugTIhVvygTvXX6iE= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0FC26EB6BDF750EC

http://decryptor.cc/0FC26EB6BDF750EC

Targets

    • Target

      d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b

    • Size

      114KB

    • MD5

      a74b5a306c88a8eac8f5ba0bb502fae0

    • SHA1

      609f85fb3400e7ba88df11df2a9b965680a500fe

    • SHA256

      d69b8666af8ca8dff2770402dbff9110e2b9533901771442b079955e055ecc3b

    • SHA512

      be4ad74324e807fa51e6bae936f0a19abf44b4a68fb6a47032a84748e7a3d9abcfa6b20f41a808019a7fa40d5ea8c7cb6a8221eb625241ce7a0bbb314c8f8cc2

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks