General

  • Target

    d4e3f75692b981f04ac942924693548d92a9e4f36337b9a3e97e596d03cdfadf

  • Size

    116KB

  • Sample

    220124-bbk9lshagp

  • MD5

    ac8a6717179673cd109e7f72f7abbf34

  • SHA1

    0dfa8c40712f86518c1f6fc07c4b1e739f1f21de

  • SHA256

    d4e3f75692b981f04ac942924693548d92a9e4f36337b9a3e97e596d03cdfadf

  • SHA512

    7af8f11711a14914317a69f58317113d4ddb3ebe51b6c03fabc681fb650ed6873069db3e6741460a5b5a2b339a479e914cd021d782e577f0143e320983f9111d

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$oFIp2F9K/gaGFIy.BHQdOus26PpzuBcUY5dV8wqqgdRrrggbzxfNy

Campaign

7381

C2

mediaacademy-iraq.org

baustb.de

gporf.fr

koko-nora.dk

makeitcount.at

lapinlviasennus.fi

huehnerauge-entfernen.de

gratispresent.se

theapifactory.com

datacenters-in-europe.com

onlybacklink.com

rieed.de

bargningharnosand.se

ontrailsandboulevards.com

minipara.com

balticdermatology.lt

airconditioning-waalwijk.nl

officehymy.com

lykkeliv.net

loprus.pl

Attributes
  • net

    true

  • pid

    $2a$12$oFIp2F9K/gaGFIy.BHQdOus26PpzuBcUY5dV8wqqgdRrrggbzxfNy

  • prc

    ocomm

    oracle

    sqbcoreservice

    mydesktopservice

    thunderbird

    winword

    ocssd

    msaccess

    agntsvc

    thebat

    infopath

    tbirdconfig

    mspub

    onenote

    wordpad

    steam

    dbsnmp

    visio

    powerpnt

    encsvc

    xfssvccon

    dbeng50

    mydesktopqos

    outlook

    synctime

    ocautoupds

    excel

    firefox

    sql

    isqlplussvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7381

  • svc

    backup

    veeam

    sophos

    sql

    memtas

    mepocs

    svc$

    vss

Extracted

Path

C:\k45h8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension k45h8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BC53E234F43A471E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/BC53E234F43A471E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: exYivQFhSer/pZZoEy1zZphUDw4aIdeJwBdoK4aC+YgopAw4ovIgqNZU+Cgzwq7j q86IGy7vvgWWB4PCeaAT7jRM9NWx7DnPaLBXxsEPASSYxlQd6DLi2vu82szTxCDV DCwSA48NHbo0d8vVYbu5OR89KHPlPQ+rbhT2usOV/6axv0XW4dlvWdZAu2mj98ai IMLSW5UJ7X6z5i2nGbAqiUDdiw7gcZOoenuc0bmUDQZOnZFDO2cafQfL4yXrsqWd JL1gXVhqRsadZwf4LJ0YdTn+HScG2S3Vs/EwaP6GySd+v4Cx+04WHt+hZwDo16nR UatbXqU/xfFwl9OkuRM1Djamke4SWaUyj5iF0b2pVDuK9/hbJ8Xta9MmxIGboq9s iIPOEAwejIWoPSKShp97kHlL+YqXIn+XnqeO3OMPXh/ZB0MVx0LhDrG/fDgV5wCw RhMbmqMu5OnXOA6C5zBnkU80elxVRMTS6LDYplEbSYYjuurjJ4uM/RDRQEq05GCM 7uVDFg8m4gVNG37soNFJCfRtzv96X3hBrTjj/QCfuiSzr77SSBp7p9vuyuSNSOV/ 4J7cAX2WAYco+sN4LZkQkRqV4SQ4smUz3/WYjMq9S4O1t5I6+2s6VElsXsDGi0dG GTikswbJGkbGB7tWtMhFeicnVC03F5u3BBIb+OpqdsBjEAT5maT32Q5wnj9UbcfO bSKh9wIg4oC9qYiWi5MOrc6uPfuqxhuKuA8COZ6PJ1Si5FuBwBrmdW8HUiNGMDbV dYUs0dgyCmuyCfwlnWUohOVR4zVYsbqOjd5N1yaLuL8pDbG9OKRfZYSpWtfcaaLT V1ImT+7l0QhTJJQDgQBIthY/8sDZ64DR/euTBxi8MO+fQaRx0+p0aXs1M4A/zxi6 vLZ0BxWEd9/Oj8zWbHRNFvZyc/6sDbNVyXB07uzmGQLc1bXLbavs7vtcc5QNCm+j GgN756wuFXQlwCaxiY96V+GI/xeRYcJoEPRn68pBPuUC2408F6KT0NLAPbKXfSPe yMpV/pi3ZIVFkISMn02fyor5yNWjZOVQqQ3LAqT2NHPFHFeZfW+YpVhbCBzgY7ZP oQPsuXRfrikgAEfLuq0UAnzm01Zu06vflObjSC81w80V5PoZDJFl13j0NgGfJaWR KV5wxis0CsZtaz4lRtc/79wGV2H4EAL41TviZrfiAy3m70rjSh53Ku2Xs9sL5TIj KeDShD4WW2IAWfAu6ZiJzAhOJJS7HWQmpt1nprnRo8kVdnz50wzz4Mi0IgI6yK7v 0j1eu3Gm+3fNth/kueXbq+3bW8WZ6A== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BC53E234F43A471E

http://decoder.re/BC53E234F43A471E

Extracted

Path

C:\3634p095-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 3634p095. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/52DB4D77625B2854 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/52DB4D77625B2854 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Vrl9snee7Rv8BfjjeInswQP+zQU/Lq+HQPMZLNku6Q3u2SmjOOnS5xhl1uRmiFO2 qqdXK/r6sCOgfF2NlMdlqtQCEgPDA1dfY1ZYqqb9Lz4b1LE6yfSGENsB7CDb1rjR ZXSi8jtz1ZpK+Fl4i9jqG6jjDEe3EJs2zY9HtLn3tBFFhLLtWupHJOOcNPWcbCEC q2MRbJQqXAgUjFEKhYmdGntL/yf45OoI9OZZqiKuof8JwJqVGrk/WgtFaNfywHB9 qHM3Totzf/O+qpfq3ZEaaExjOAjGofUJkDFttre8ez/tNl1y/WwSm1xdVR2ShN2Y 2pSeO/0I3oGokIF8pkZ0nQSdKBbI4jpsV2tH7Kj5P0s0boAnoxQNp9oaAox53Q0g rvdB+Yb0tsoBFh3dpdxIXmlx20QT2py+uqB8v6N7IdzAK0EcKTUEQJz7rCbVft6S 4ZluV4lgg/Ab8Jb/o0yCYG1V0EUwhL5ZcPRo/SHQ6PjxLKLwQT1CkL3IoaBt2EBB fpwsnA8G6JGcL3faWTRAtvRtgwzLgN65KVRgtYGjjtw+Rrma1d1hz+xXfP5jf/Dj N6MaD/aVM5Euv0FJ/PP+gi1WaazjqCJ5/9xeVW8YA0pGiZHzWhYaDNIXtH5uU6og KlqxvDlVsgqQoNXvi3k74JP/4ol02P51sufPZXGkHAFg0cKgAEv1ckn1cGfrpDjK HQMJKpV+gna/ycldVTRqW+GlSJBt37F5GFi8SqK2xWnaIxmrC5dF7n+vuKZR65j2 dUWum+bzilrOjfUsxnX20y3QqarPHJFw+onfDUdb+BwWHgnFO88sBjmVzFykEssU HL86wsrQTDl9zMJEDqBbLwUwC7FCfZsCpmOA9fT/WqYaKF6YRr86ymLKjwJgqOdW NEL0Pi6ZVnFMYwwOY9eZ46HnOTchzq8V9nGTWIFkPu1+ptPT8Id0TvQWBOR5VRsN +T99E0EmnyVi+QV1i81VDDqYmu4iOZlMS0xDw+J7ls7f/M4hYS2LwBiiKCXxp1rr 2nAC4CGMtnX8Sf7i5lpRDJxgdXOFtjumTUUBXhNMOuex6EaYBIv8BXv1LA4ibrQg JbwKAKvgaL/v4XcvrkEFEjYbrLxJh3ySclNwqAV0ejHF0syoUwGVSYTL67yZK7K7 5crFWuOwQ8zM4DaT+PjskMqkILj/MvX6A3SxoY4trlXpO9eP8FEwq3xiWNT9NRXR undC/aqdRiucGjTGqX5ylzZXBUfiECY1Mqifs9tQGLRVByWeEE2XxLoM/c17A1UV mXuik/gR5hSzc3NRkwE+s4dJCJM= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/52DB4D77625B2854

http://decoder.re/52DB4D77625B2854

Targets

    • Target

      d4e3f75692b981f04ac942924693548d92a9e4f36337b9a3e97e596d03cdfadf

    • Size

      116KB

    • MD5

      ac8a6717179673cd109e7f72f7abbf34

    • SHA1

      0dfa8c40712f86518c1f6fc07c4b1e739f1f21de

    • SHA256

      d4e3f75692b981f04ac942924693548d92a9e4f36337b9a3e97e596d03cdfadf

    • SHA512

      7af8f11711a14914317a69f58317113d4ddb3ebe51b6c03fabc681fb650ed6873069db3e6741460a5b5a2b339a479e914cd021d782e577f0143e320983f9111d

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks