General

  • Target

    a8309e454d9177a8fe2c84c79925fa800282f9fde2413f219dbf60fc77dd37a1

  • Size

    180KB

  • Sample

    220124-brj2gshdeq

  • MD5

    5200743e7e5ca0ffa5fae8b9b15a4f06

  • SHA1

    492cc1dd555bd88bf469b15d952405bed86c24fb

  • SHA256

    a8309e454d9177a8fe2c84c79925fa800282f9fde2413f219dbf60fc77dd37a1

  • SHA512

    dd834e3bf4cda789175ef55ce4752ba263cbccc120182c3d5a64eb738d3908a71774f8beb6c28d102a248691060d3e536baf04ee769fb733c9f8e44829bb9d50

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

312

C2

activeterroristwarningcompany.com

letterscan.de

jmmartinezilustrador.com

web865.com

thenalpa.com

hepishopping.com

donau-guides.eu

bajova.sk

rino-gmbh.com

bluelakevision.com

thegrinningmanmusical.com

tzn.nu

thesilkroadny.com

photographycreativity.co.uk

atelierkomon.com

basindentistry.com

belofloripa.be

rechtenplicht.be

hawaiisteelbuilding.com

oncarrot.com

Attributes
  • net

    true

  • pid

    19

  • prc

    msftesql

    steam

    powerpnt

    wordpad

    dbsnmp

    infopath

    sqlagent

    oracle

    tbirdconfig

    sqlservr

    outlook

    thunderbird

    excel

    sqbcoreservice

    thebat64

    thebat

    xfssvccon

    mysqld

    winword

    sqlwriter

    visio

    ocssd

    mysqld_opt

    synctime

    sqlbrowser

    mydesktopservice

    firefoxconfig

    msaccess

    mysqld_nt

    ocautoupds

    mydesktopqos

    encsvc

    veeam

    agntsvc

    mspub

    onenote

    isqlplussvc

    ocomm

    dbeng50

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    312

  • svc

    veeam

    mepocs

    sophos

    backup

    sql

    memtas

    vss

    svc$

Extracted

Path

C:\h1h0xnbj-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion h1h0xnbj. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4B521D7C8C477590 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/4B521D7C8C477590 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 5CF1IaKq5TxhZcrEJDSkAzI3DsPAhStekavq5U60cqTGGoDB7HJTHtRxLWvMEhs+ yWkp3+Z4nfxZLfUq44+4XVhYPk5tc//z9NoHVsoqIWRXqL6YT3+XU9AOUC1/PRDW lmszotlELOoGSrfFk/iAZJjm8wwjpmyfVRCXXvFOAcgCzyYBIDce3npV/9OLaE1Q phPqZkPRZ+vY+sr6CnPRbqqhKrvn9+hPjJTMB7bdPdHOvcz3XQx40I4Rc9VzZTQM aSJpSWCgzFKumbqT41cR5pvWdGKBbUWCFoN40jxi69ZpsFVbyAlmCQRIELi+bg5X Ip2UFBCNbxsUkc9NAIXw8qxphNDiUpMobnn1p6wMQZtF50AF5u0IRRRk14QMxCUV /MwQCjRIGNP1Dcwc1fltaCYUwhIqn1ubpUw7hsTNtxsGC4J8Tjtbl+3Y5+3N6Z0u KBAwy4zum/BEfhcNGlCK+bvbculTxXxMLh7xBJc+eNgvdMG+TdPaYJtVXsXFJ9sC 77LhxzxIQQEu971zh1ywKLBvkZB1vZtPjKtAkUUo2eynXA8PZRJk7Lm1vSPoza13 HVh3M7inBbS995uFO5D7Iqc3XU4+FgpPKoDG5GEt+FVfpcTKYiMnjolNDj8smYgP EBBhYQ/Oh/t7ZOfOhaFF+M8Uoy2rBk0x4n+GtSrgNflqxfr7hh69Ciqok7EmcEt0 zokwseFrEvVYjrPE8FxtavfOr3hsrF6X7iY/o1nKFG9ZixHxe8LYxfCNtw6Zi2bL Apr51rQHvTZ2Y4CfQcTkAvBanaKtZJHjFFQZY0P4ZaMde0d5nJ7bPGuT5UXSb1Ux n/szU8wyX/EfHAyezsam0oIhCwWdCKAmtHzBypaTpOktiuUs+Pe+d1s4s4OzrFpV gL0H0senrLLCmRB+h1xvfQ5Ezv+nPA9gH9jRXMn6yH1bdk1jvpQfscK4wVpw11Cu 4a7cIthIY74H338nQdv8FFabspBYlYty2VhPuOk/vHL8/oKKqGkZYRetBd4xa9OH xQiFOHmeHBxX6I6/wGzmI62AGaQDRyF2InkWrarMl3wsRRYnyePUFd0cV2RLabLY zyp9ANvC22Y6edSdrPicfR9RvZ9EgvCNIOHJSimiml2cPpdibVtlEp7B6W9mh+jp W0ZfSNNh Extension name: h1h0xnbj ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4B521D7C8C477590

http://decryptor.top/4B521D7C8C477590

Extracted

Path

C:\s5abe080u-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion s5abe080u. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/517D60F5325F0952 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/517D60F5325F0952 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: N2FaylmM2HBh4T9Qmui4Vh5HXsIwksbsidveAU0Gl2N9q8qRpTdrr8/TD6Bx/4L3 DlsShA1vs0eSfXz0RqrI6qFv0OK9gMSHJN330WacmXYf+muekKSdB+s5uwPU1dr4 zhyokeYYS3PsvHfqRLlwdTetFAj1sWjolJHgwfpnZXVN6pyXUMae2HVbCd84LYGC VZGPqhG9jFnqWI6mue5PAwTileMEInhat7Z1OiTFMKqV5RdDqR1Y6CQPkrEtkM1L quETin3h/7j5e+Js4z/lGFykyaVmN8GD5lmUaG5QnXHCLhzmzOngybt1cBAsxLze JEFrMt4bZYPdFD6CC22mIxYA2aV16J0QR96JVx/aW4SL5cLzwqxPwhwB1UHFf4Wk GPXQ2EWLFtIWY2Z5gHz7FqxxLnr4t22A6OIH2g9eCTMdLp7yzEcGbc+lEwzmYFKH fDLKmK4l4z7LpkfDysUrRWL16gzRf9e+oSoGYT0lDmwHwrq5SVFiYs3QMyMTzDUB KKpf0cLBcPJz8yTIHTpU1DAmfFLStJq1fB3lBEzGCq3HrhZq9kW+7+I3p+vCslZD LsVsSomK0nh9yDlMcqiaO+EJwlMR/8Y92YZolIkPtWa8SLZHBgvvHNvog/v7CwOE h32i/2lilATRKUKzJ0Jtss8uaVf2AwuLHvND4vz7lPHX/+8UsahjU/Le4cMcB/Pe ndEzTnA40ItNKvJu1YKF7NBw3hIuoAwFAOJyzasOY6Lq9MmLIJpgoYXIlJAZEYtu LfFa7e6vuNmW/1Vglo6Ln+vHL73J9l86oTRIa/MYIS4JINGs31lx1erfnL8AEpDy JodrA3MVKtyQB6+vQ5jgv14tMOFT7ZYbU0PKvZBXAkdFUl3YGbvM/0bGCVf5RlLF noqmE90W61pPzTu8sloHvcdzDPZKU5CUUi46awzGySGuUKJAYUwfJC8kpEycThDp sW42VhaDUrbD59ftdP2aYUfYyJJyVpmrLQpkZ9B3zwhVXG08FP3es0qb2CqKcdEm vCXtU8jgqDdX3IbYgKRoRhhSx2g/kNR4mtRWKUUBz6nXhTlzZDdjWvwTQtBHCPob s+tehw1b93J/aadJXV+QgzM6MF+eRRxkuay7UbLzpZCeZgy0HMfYiPTHUU4ikIJn Extension name: s5abe080u ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/517D60F5325F0952

http://decryptor.top/517D60F5325F0952

Targets

    • Target

      a8309e454d9177a8fe2c84c79925fa800282f9fde2413f219dbf60fc77dd37a1

    • Size

      180KB

    • MD5

      5200743e7e5ca0ffa5fae8b9b15a4f06

    • SHA1

      492cc1dd555bd88bf469b15d952405bed86c24fb

    • SHA256

      a8309e454d9177a8fe2c84c79925fa800282f9fde2413f219dbf60fc77dd37a1

    • SHA512

      dd834e3bf4cda789175ef55ce4752ba263cbccc120182c3d5a64eb738d3908a71774f8beb6c28d102a248691060d3e536baf04ee769fb733c9f8e44829bb9d50

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks