General

  • Target

    c6b18ca4a98fa8a41c7b8e85a01d8a7033d009fec9e4c6ed3fbe3848e4de3229

  • Size

    114KB

  • Sample

    220124-bf4xhshbgp

  • MD5

    1475558f6be0912a0fdc158ae7c0c34d

  • SHA1

    ec0024a36c2d405351cc124a367c0724d3057a08

  • SHA256

    c6b18ca4a98fa8a41c7b8e85a01d8a7033d009fec9e4c6ed3fbe3848e4de3229

  • SHA512

    60ed27c990b0fe1601ff9dc6606238a876512e2b34f15209d9e70ac931ce137ca8e6016b79165fe641772afe039b0b5a7fc6dc9333c9eed5f7dc51a50facd378

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$BVp0vD8jbQyx0.h5Cc5.jeu0zTxSIS1RBopxbiGEfkXT9xw/KWhJm

Campaign

3972

C2

lapmangfpt.info.vn

jyzdesign.com

compliancesolutionsstrategies.com

tanzschule-kieber.de

collaborativeclassroom.org

seproc.hn

oceanastudios.com

binder-buerotechnik.at

leather-factory.co.jp

coding-machine.com

zieglerbrothers.de

schraven.de

boulderwelt-muenchen-west.de

thewellnessmimi.com

zewatchers.com

carolinepenn.com

socstrp.org

handi-jack-llc.com

sotsioloogia.ee

www1.proresult.no

Attributes
  • net

    true

  • pid

    $2a$10$BVp0vD8jbQyx0.h5Cc5.jeu0zTxSIS1RBopxbiGEfkXT9xw/KWhJm

  • prc

    dbsnmp

    mydesktopqos

    onenote

    msaccess

    ocssd

    synctime

    steam

    wordpad

    sqbcoreservice

    tbirdconfig

    xfssvccon

    thebat

    mspub

    powerpnt

    mydesktopservice

    encsvc

    excel

    firefox

    oracle

    ocautoupds

    ocomm

    isqlplussvc

    thunderbird

    dbeng50

    infopath

    visio

    sql

    agntsvc

    winword

    outlook

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3972

  • svc

    sql

    sophos

    memtas

    veeam

    vss

    mepocs

    svc$

    backup

Extracted

Path

C:\9232wam-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9232wam. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/401F522B2504EC03 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/401F522B2504EC03 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: eHSzuzo3qSmjPQ/k7Jm152Dd/+N17gyas5/ZmGRjJXZIVQ0JB6Z94k2CjagonP+D H3jqzfb1fGOJwQoDcCXrasKT2VhmqRa3GZqn8Un+bPRa2xeCruCR0VDkDmRSBDaT gtrKXEjBOAifAB+oOpmwVxdWIDgVaIIfwSxyU1npiF0AXJ9ynvaqqZMl90Ee0MOV P2MatjthyBudFdoaabywjTIym8AxrUnmt1IReH4gjBTpKOnt3IMQzrZNyDjeeu8s QLqN7E5F0LXD9jTUrrRCMHv0jigozR0mqvAPfMpS3cWm+clNc/9OTmAHybY0kDZN wKA2afhBAKoSiNkDouMSiZsikrcVTnm/dxnx/t2lTH/VpkendNF5YNrNlz99F09V AC9bMIy7Is3Pwy2uVTTLaH7UdnXm2f+IN1xGgtRFqI1ErR1UFNr/vM70jZZUADHy rUQxEOjPPZotl4Iboy5vm6w9l4fcYUeTEx45s/p3ZE3ubakH55G2BncYUwfOaEmQ +rEPxnEfuZw5DPM5t3LQcJAqJMP4WGy9gqlVSDJGKDh/Lc5R7fyoK3NO3lIcWthy q0DeUZ+q9SRLAKbpJ8cRpT95rsDMmK0nWN7s6sV4f8CTHBdFLZCuEi9v+hu7pkRS JnNKKDFEXlD7UwDSN4Iu/ex3m9ye1lordmuDwTEIVVCapt/E45QwPuBkmb+OX3UI IDoOpaSsNB+q9SnouSeRHfEKUn4dFqr0DCxJmGlXG4DODyJw/XmgKplhdLqQ+9/6 6miaCxnWYBmnujBS5XLljpm2R7ldLJCix6kleVME6lF5ZWqrCOPyqmpsRsYWXd9e uMHq0tWwagaXYRLEig8xTCoE4/tL6J6NWvIPVdjmwYUHGZjMupLc/xO8yJKxYqg4 jUB7BM24MP1Q2aN9f7gPBuxlqF6iuMwHG20ib2trr6wd5ysnEmZCNpw73xrMrsfF mIupuVRtH/2qJbqC9MOv1RuQsTcPToN1X6wkaiYVczokYL3RFPivTxyiw1Vv5DGR LOIlS+Qfuskxeq7tYACkm6iNQV9ZKxPQCdQwwQQjdA7KDiX0mwIXHCAfRb6fsV1s 6aHrz8WzUfGl4kqSNFBGDmGnuNmhNxKg5y/mrrA7kE2tE3LCfnf34LaWW4kQiap0 TaLRV5ZDJfnQaBKS96qz5LANSUEalGpe/Mm0XG3GY+Clh12U8wJnHJ4t/VQctaUw qopsO6oTYovz0owiNVKxPRZLGvcBoSpy/NYKmkEtqKOUUrRqbo5o3ZiJgZwH2p+X y1nB2xoNBs92DCixkK1oKe0qPzeoeaEOI1Y= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/401F522B2504EC03

http://decryptor.cc/401F522B2504EC03

Extracted

Path

C:\a7wwn58-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension a7wwn58. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/89B665BEFF55460C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/89B665BEFF55460C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ORDI+aOX/mKp3PJAF2Z2MPYKP9WOugfAnNxmdbxoM4oAQLGYawReBm+e178ZlP14 JVl6FkvFV0UXAJf9tNmfKbmHKEfcijtfn76AK3HzLab6hVkgVKqu7l3Dwg3vgD3M DgCQDlWqfQqnelEoC7A+CzhKRGG5jmBmRnqXGUDc7DPPEEHzsCvJnqSQiHl133w7 I63tRhtTNSrS4eaMly6ORQdfoaMsdPFiTsEJ/RiBvQuInL7hVWW1IpojOOYeSBLG ELc7LNJtw25De3FZWMrXgQkpCRd9+/oyqf7bAtb9Dj4O6UDOm/2I/7SmkxN293sC gEaOxYGIf7dmqc6PZ3ISW3y6uhRlkBx+1Rd+zU+9hWWQbU/VNq0Ic4lnHDSBtwo2 kbV63XiO7Y82IGaz+w6kPnLbs9xhN1ZoObFg4U10+Y6zYr29/YpSqxSQPGIY+2Ja 9cCkoEOp3o6qBO7aHKJ7HW7NRJiEsISGPJ5G0OurRO8un5cOQeO3yN+t/3369p+v 9YV6+1lMexNqB0vcw5lPB2XjREGvrU8m7PBY43olm0x9YtDcdrCKVVDjp+cUWmWu JPvmgJYuLvmDBnKhdEelCIO7VDIbOJUdEC8VMJjLU+Aiz/QJqW07ZKs4czZuy+xr lDrRBnRDbAPfGer8V8pdDk2r7Fi5MIbs3YOcs+G6KfUh53ELVXd1Dc/A6Wj2ewO+ gtalBmIstwYR4N7lm32EH3gHPByx729Ge3loyxXIGmxekHey3/ESJjrPg+kZAqWU YDDCAESjqiiWQYLy6JD8yli3YV7NZYBlG7TsyZTtClVq6whdaSfw+xyTsh7rRFFs /4CvHfED4xVxe1bLeG0OV0VQU29e3lsdltrAK0r4w0ClPgNEuYPWgm7X5JeiIns+ ZbB2RKclhqsEzU9FF0kzOhhd+f/RBy4FD72UejKTaVLK5JszhDH2Tn8pBOf5nO0i kMnNXLcN+jFywBPtJlyTZjQI7kx8yQkeJsQcXLl2vT7ZPrZYvqwUH0jlP0ryMWN7 7rcUWjU2aMvon7YChVpSCvV3i9/Z7H6h75/RAU9+XUDUailvX8PZGIEdXM6SAew7 ucnNcB45bqDr6SVk4dA2TV6wBWhWAmMIC++P/ApCFVfjbvOzI39AgkxoGdfPrKF1 cJK4X9n4CSmMY7nOuSUr/4h5G8hicT0LOWiEoZYVT5Pge1G1+0cbVW1C/L3qxbx2 wZDdQnMAL881YNJWOcoYZpB653fj4179MquVJ3elto7p+2lmCvJ57kh8IWyrcu09 kKCJMkwH9TyYXXaUAbWKEdmz ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/89B665BEFF55460C

http://decryptor.cc/89B665BEFF55460C

Targets

    • Target

      c6b18ca4a98fa8a41c7b8e85a01d8a7033d009fec9e4c6ed3fbe3848e4de3229

    • Size

      114KB

    • MD5

      1475558f6be0912a0fdc158ae7c0c34d

    • SHA1

      ec0024a36c2d405351cc124a367c0724d3057a08

    • SHA256

      c6b18ca4a98fa8a41c7b8e85a01d8a7033d009fec9e4c6ed3fbe3848e4de3229

    • SHA512

      60ed27c990b0fe1601ff9dc6606238a876512e2b34f15209d9e70ac931ce137ca8e6016b79165fe641772afe039b0b5a7fc6dc9333c9eed5f7dc51a50facd378

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks