General

  • Target

    ccea7a2ebb3e9ad4050c6360fcc609e09f786cfb64e938ad5947776909cac0b9

  • Size

    165KB

  • Sample

    220124-bd6y4ahbg9

  • MD5

    d86a81e9631b9d1f82d90bc4e4ee864c

  • SHA1

    4334a7d004f9b6b7754bfacfb71c0f8ee134fd24

  • SHA256

    ccea7a2ebb3e9ad4050c6360fcc609e09f786cfb64e938ad5947776909cac0b9

  • SHA512

    0a2d653dd92252eb287aa2eb77bb5103285aa4de0c9d1f22ce7c068eb934b2988addecf5b00ae71f76b90b180da3bbb1a46e8e2a3191173768911934d33a0bcc

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

29

C2

hostastay.com

elex.is

katherinealy.com

dcc-eu.com

teethinadaydentalimplants.com

topvijesti.net

aciscomputers.com

renderbox.ch

ncn.nl

internestdigital.com

primemarineengineering.com

soncini.ch

pvandambv.nl

soundseeing.net

lmmont.sk

hm-com.com

spirello.nl

linearete.com

energosbit-rp.ru

schulz-moelln.de

Attributes
  • net

    true

  • pid

    19

  • prc

    dbeng50

    outlook

    steam

    isqlplussvc

    tbirdconfig

    dbsnmp

    encsvc

    sqbcoreservice

    onenote

    thebat64

    agntsvc

    infopath

    excel

    mydesktopqos

    wordpad

    mydesktopservice

    mysqld

    ocomm

    sqlbrowser

    ocautoupds

    xfssvccon

    firefoxconfig

    thebat

    sqlwriter

    thunderbird

    mysqld_opt

    powerpnt

    winword

    mspub

    msaccess

    visio

    ocssd

    msftesql

    sqlagent

    mysqld_nt

    sqlservr

    oracle

    synctime

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    29

  • svc

    sql

    vss

    backup

    memtas

    mepocs

    veeam

    sophos

    svc$

Extracted

Path

C:\74qt03-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 74qt03. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9CFDA1911C1694C1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9CFDA1911C1694C1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IRU5jVV69SfhY0YZmOx5wByPu4OcAtntsW1TYKF0x7B9twvpyCpHUGe8u/QwzHXb vHSo+LmIzZZRiEtgqOC9DYZFJ0NoJq1qqMU0f3a9tTERnJqCneSTm3S5cJ8HI/TS jWf3ADiurN5wvMhbqF2wf0X1vMp5O5E5dvAmyVPjnG1v+xboFhSN82uOjIbgH1TF eSTUfCe4f+mAzDG5grhUP6d3SYmP2v5AKtUOY+SsEHWlCEE7brZZXCA3iXTskH27 /NUUaMqI0rqxQSWBW6fwZLLJW+Rz1UxVYJZxA90vOQJbHHfo26cxG8wqNDfkC4RX cIX2wnn4PXV0KQX3qAKAakRPkXGz8RumS5YX4KZAfEY5YPNBzJ0Ontcjzw7gQFOE 0OlTkQ6CIcN3UFE3OLj6nW2lnEYC8nXNBlbhV8qX73fbL8cX/T3pqF3DwTus4Tx2 lL6SxURWmKkxAhfXAxSCmnZhLV14I5Vdd2moGJKD+aOb0Yf+JvBfDMFxq6ZPXIRk gpZdNKiY/uKWrf9zkdYujC/DOUM6BQEgYn/kvNdcudOpffybGhDsuxl3C2qDVKfz QIpP+6wbzzj3+ZeoYvmGHaSfBD/NF+HGExfbla5kUgXqfNKsTvb/ytmeCy26QPWQ Fj2L4QSoAMwFHMzmEVNv1TMAaysEO3mwAu6p96w3q9/IFa1EBpGK2wnafI+tf/1k lsTraJPAQtUVjJSetMGC7hIJ0P5L6hB6mbVi9cYMua77QwINlX9zIjPruB0TNqO2 Z6FBh0nMMA3BEPC2ntmau0ec5kFFDvu9Qx2dpLOxWqWY0/WaJgOIAhftAkqoXXZn IrDCCFrDy4XecG+W9La0nQV0bfBhxgaoeEZAFA3lct2iyIbsLF7+IwxGPhPd1etZ SxS3ZVe1/D2ywkjF8CroMvKb/9jE+4hb41UKAAi2L+YBsBqJ0aAh4CH2vDq9krbP /L3wQ07kWwelg89kZ+XeRjPFio8/FKZpcgge9b31LrG11KaW2yIj+UWbN+5Qgqnp 9OwzFz8kJVuvAEDuojNe7jiEJpTFBqN+p85ZIQv83pBWQ0yRdMKoewDtCdxw63Ad 7TC6xsBAsYI2ipxnVpC/4SoZwpHeX9vwo1oZEAbiSKs33lEnMTkCXrUsPl3Nrggm Extension name: 74qt03 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9CFDA1911C1694C1

http://decryptor.cc/9CFDA1911C1694C1

Extracted

Path

C:\d0sy13k-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion d0sy13k. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BA6E41C61A674E8D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/BA6E41C61A674E8D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +acZU8I2n56u06h49Bshy6K7B2c7IhhNwz8SlhNC3aBH9Le3lEml5JK8amR73BFe NtVfOmDOxlv7J2+j9mg/bWHTJxEBq2c1COeGpD3jvNsEHg75mJb3p0CXb8BfR1+J BpieV8VrT5CaCvOsKFR95pwNVBxPQQQNwavOolCr0t9BV/jtwRJA+uBYhKSAjFMz uuWmnPt/KwBiAA+vLiFW/ZBpCQLGTI25qJR1B0uunuSr4kkcnDgiuJI+2owRMJeP koFBzA0xwvXDjpoQIy6mMxDx073V3tkZklpTDndHIF4xGfy+StAEtzzjdydKXRtD Gu7bY4iofguj4lO2kvuldVA5vuFNgFzLL8xlJCWg7KyZsnuHOcdKsF2sKCRdTlz6 5lovwi1c2Ig/1Xa/3gV7Khg9FmzMtrRuB1hDE7RMLzuNv0koy9NWL3/xcBvf4SXT xByblXFkJTjSC5FbN1xuOZNSBvobjUxtWl8FV5eE4X3rruELQbkOJTYoyjXQGUjs 7SwXzmVZ5e8HUaBiGBsASjhSK7blgGcgQmlqZIhos0Lq41hhAGmVq/ZaYgcaaf6/ OVis/uUQ9J294/b4r3sGPinXdJUJodva/e+Uc7unpvzzhmaZzA+B4u5zIpaUlB1X ZOJYtY0Wtfr+jd0HZwqYa9y6EB9mXDL1OiShv5le4pbUZHnCM6sq5ErhWMpzOLR0 zTm+Hqfrk7xEZChh5fbCgpxndDEPU1zv5rxcOGbIHLUYqT//ATrd0Sl75sCCgv1o 5vZzwRB6CIj3w6hPg0nL2t1CKAsl8xTDZ/EK5wVBWItAPru8uGY2tBIBuGxxzwnL T4HyAsd1zmub0hFTxlIQz5gsPIFGTE8+avQXnyzTBaOcaU+LbpIkU+i4sXsvdnuF ckD5latAvX8aew+mI/IsbWrGM9D56dhr4R8NyX0G7xQTEKFRSolkG3mShgeebPyQ D+FZCTo+mP3fQJXRWQVXkVQ0/qY715Vizov/lATYhN0ixBhwQT+bvF+ltqSrT/Uq Jv0Wtn5HstjLqT4Dqm1P0DXm4SCjb8z03Zhf8YRGYx2up4IFKV3chtfCps+XBql6 w4zJobHgPmp0/OUlQurhLQEKIm9fWvawAB7vvogoDu+WKR5bpSxm0kmF Extension name: d0sy13k ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/BA6E41C61A674E8D

http://decryptor.cc/BA6E41C61A674E8D

Targets

    • Target

      ccea7a2ebb3e9ad4050c6360fcc609e09f786cfb64e938ad5947776909cac0b9

    • Size

      165KB

    • MD5

      d86a81e9631b9d1f82d90bc4e4ee864c

    • SHA1

      4334a7d004f9b6b7754bfacfb71c0f8ee134fd24

    • SHA256

      ccea7a2ebb3e9ad4050c6360fcc609e09f786cfb64e938ad5947776909cac0b9

    • SHA512

      0a2d653dd92252eb287aa2eb77bb5103285aa4de0c9d1f22ce7c068eb934b2988addecf5b00ae71f76b90b180da3bbb1a46e8e2a3191173768911934d33a0bcc

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks