General

  • Target

    d1714cb5431686897531f1a969f309078414f75240086a86de8aa15455203e8b

  • Size

    164KB

  • Sample

    220124-bcgmtahbam

  • MD5

    a8dc5e8b813633dc72cac2ef60475e57

  • SHA1

    1f9feb436ea56b8205511ff1e8c6b40f19daa77e

  • SHA256

    d1714cb5431686897531f1a969f309078414f75240086a86de8aa15455203e8b

  • SHA512

    f99c5837a060418e45dd4c53da02d5899e701d4588362a9a35f205d6b59cab87686662a308653fb0405f5d82a1736645b0e5d7a089c467a252bdc7e174ba0f8f

Malware Config

Extracted

Family

sodinokibi

Botnet

48

Campaign

2699

C2

goodherbalhealth.com

monstarrsoccer.com

happycatering.de

radishallgood.com

bluemarinefoundation.com

affligemsehondenschool.be

mazzaropi.com.br

amco.net.au

gurutechnologies.net

boyfriendsgoal.site

coachpreneuracademy.com

acumenconsultingcompany.com

mazift.dk

enews-qca.com

cl0nazepamblog.com

buffdaddyblog.com

saint-malo-developpement.fr

enactusnhlstenden.com

bg.szczecin.pl

dinecorp.com

Attributes
  • net

    false

  • pid

    48

  • prc

    onenote

    tbirdconfig

    pvlsvr

    powerpnt

    oracle

    mydesktopservice

    VeeamNFSSvc

    thunderbird

    thebat

    vxmon

    mspub

    bengien

    outlook

    ocomm

    VeeamTransportSvc

    DellSystemDetect

    winword

    dbeng50

    raw_agent_svc

    benetns

    excel

    mydesktopqos

    wordpad

    sqbcoreservice

    VeeamDeploymentSvc

    synctime

    vsnapvss

    sql

    EnterpriseClient

    agntsvc

    msaccess

    infopath

    encsvc

    bedbh

    firefox

    xfssvccon

    visio

    ocautoupds

    isqlplussvc

    dbsnmp

    steam

    CagService

    ocssd

    beserver

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2699

  • svc

    CASAD2DWebSvc

    memtas

    BackupExecRPCService

    sophos

    CAARCUpdateSvc

    MVArmor

    MSExchange

    BackupExecManagementService

    AcronisAgent

    PDVFSService

    BackupExecJobEngine

    svc$

    VSNAPVSS

    mepocs

    BackupExecAgentAccelerator

    vss

    VeeamNFSSvc

    MVarmor64

    VeeamTransportSvc

    VeeamDeploymentService

    BackupExecDiveciMediaService

    BackupExecVSSProvider

    backup

    stc_raw_agent

    bedbg

    AcrSch2Svc

    ARSM

    MSSQL

    MSExchange$

    veeam

    WSBExchange

    sql

    MSSQL$

    BackupExecAgentBrowser

Extracted

Path

C:\412lx34-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 412lx34. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBF2A2805917F7A8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/BBF2A2805917F7A8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: q9VLpMu6PplSjuoU1M4vs48XFEXnV2Cy3Qlx1qU+kL6Ej/OlPqS5T1ZGGtxFAUzb tRaNjVwHRiodn6mvo1XbL4WlIJdwYM8Y2cSgYukwMrkrf6+8YmHBKivdYf9uFavh isEu/vpry7p4ObeELoEDS6l/NWwfb1lWKJdjUdiDPAq/zqjftQJslIzMPXvQOAge ThYZZdpgG0DW9G0mDAh0jA8TR54vR467g5DqdnSotL2x+JffAuD0vYkEswOqgEm/ NZmXjmsmX+JbSLXWhyXJUmKcS1SeIXQeWMGXGDMunncyblmQGALt53I4DR+ap50f CqGqcnov7d4MN29tkgbkJaMjKAm8/YNas/+3I+ngSL+RkHFza3h0G2kqrnnWQu7i qVyd2yP4zuoDP+pGj8lsHewT6dATIv3wB1O7/mk+kCT9207Pnzq/AGGKWr4QGgHS XAKgBOIG2ULJIWxVD9NFnvVeR7mseuP6qSmieGevS71MYwP4uxeO1dHchhwE6A7X Jtx65ogfTcsDUQs/eVG6ce+w7QiQeEFXGOOj0/yAq5f+6zXhPNvBBT3EZ9w7+SXb kcsnajWvo921jU66g3VnEvyBkgposyNgu3+YyW8CXYo/4B5LJEJ/6hB9tqFn1UfT scbTnWwUdjDunHSPH1N/jQ56WQIvvHebc4845DkX4jUcWWlA1UPlCQHaHRhfItC0 tI/wbklBbloEciPqB6J468Vxw6UYScJTMKrugCuDafolT0LxWGHpiD/iyL3q9JMa tGAZlFVfPjRQZihYLxVSKCmndObSxrX7IwoS05Ub23x+M8QzbOQhM5JbAQYXaSRr wbj1DUNexAvR8oD1ZuSfdjdCrRAflkEgu/dDTlLvB1dPk57g9dECfFhJwx2VaS2C /lBgHFMKbLcfDu5QEyDwYe2DV7ksDu9ED+JozqxQcOJYE+zmZhDYk62s3vMgOVGa CbOk2ASrnh7TDb3UZMYfH+65JaQzLOHhiaH17JHm7/gcGCvR4+PRW5XomgWyuC95 A5mfi5Wb5ueksGzQ+08PPXsmKtA/z3IXDyR/YKOg4Q4CsmNo9OYpq3bi5/5x7Zzt 5u/nVnaZd/V1acwZjrU1M/CbBhz8VlcDs08YXPTw3hboU/aSIadOntNp6e6jyyli Pbbz1YmE ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BBF2A2805917F7A8

http://decryptor.top/BBF2A2805917F7A8

Extracted

Path

C:\a924b7j-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension a924b7j. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B06AD57149FC7792 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/B06AD57149FC7792 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dQzBCegEbe0EG+J1ef0bhkf2rdiq2aRQvuKmGIv7x2td2gLkA8a+1RZ7TjAww+TP dEeYaQu5WtKjdN0+jGeEg+HisoWXj0htcauSVLE3LQ7UnJYRefrBqihMhibD9xYo v8OIehbVaLEfBO1CIVV3dp1h/asBSXanKfizwQo6JhQuffpMAXg69iwe+ZKHsFe5 WtwEhgdhbSehJppCd9MWNdUM8ssSWYb3SCaxnRmhKz8lVwra/kmMesxKqfdw3XZs GGRaWZvPDih3Hstc946/PkffIeVtNvzSPLdH0DFmYosvb1JQS35BJQm8l/3tzsrZ JZT9QACSMN0n0ROG92pxb9Yhgu4tvHBXawEubjuayuHRN5D0SSLtGDH3YGknvxLw 34BT7EkwZEmV0ySLb4e26Bsq7CizV2N24sqh1MTntkhJz55zoqPuKA3VA8UUC8Dg sY+ze/X38Zs/hh//bqp4dHYEIPUpmURh2hz+PtSwJamuhBH6ifkq5r82ocLyD4bV 6zfdCc1nUg16SQPZcIiXoGTT28c/cBzomtt1ZIVmhT3PHQmDBRjDsNM+rJ8KqUdE tkSELW6XVf1oq9zFIuIrcTYvReQheNRXWPrSsHUvf2djPxc9zRx3LRaME0f6sc5/ 57lurHtaruAHLJvAFnWWvAgjd4/3MHFL84Pu0/6u5wF1XdDgk20bvQHVU7KxZW4b zM7H/MWKJvUnpdeGH3RoW4AY3wVZBLgjuqAWX1KGgXNM5GXAKdotvgocWadPapux 6g3FuLlsElI2UGBgnlR4Ph0WtAUHTjCTHuJz4/7NlmtjnlZMFtIq2mYvMZ16NCEc 8M5Hg6W42dKEcuKhv5OeJd9qzQQWf6DJI69/b4LjUp8duTMvt4faG/ib97UG7B42 gT9JBaN/RIOFY3+bb9OcoB8v6coiSXxww3QOMMNG3DnS0wFoy7MXl243z2Gtgf5B ViFMzSFKKplFhuoTmeV6A/7hUYlZEfcbJChSLWOWcuI8BIVLysIck8oyd+czPWAp L2xlmiaQCMHxZvYXjWIX1YuWBeQRIMOo/IPyluOXPVHYd9KeAEfqNiJmkGelrb0O jzrwslyKMNm65AKbTJ9xxkFkT6lwytj51Dy9CvNUPjkWcG10/g3NTrsfgjwIXQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B06AD57149FC7792

http://decryptor.top/B06AD57149FC7792

Targets

    • Target

      d1714cb5431686897531f1a969f309078414f75240086a86de8aa15455203e8b

    • Size

      164KB

    • MD5

      a8dc5e8b813633dc72cac2ef60475e57

    • SHA1

      1f9feb436ea56b8205511ff1e8c6b40f19daa77e

    • SHA256

      d1714cb5431686897531f1a969f309078414f75240086a86de8aa15455203e8b

    • SHA512

      f99c5837a060418e45dd4c53da02d5899e701d4588362a9a35f205d6b59cab87686662a308653fb0405f5d82a1736645b0e5d7a089c467a252bdc7e174ba0f8f

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks