General

  • Target

    93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3

  • Size

    122KB

  • Sample

    220124-by7q5ahff6

  • MD5

    6d5e018e9de53f8c7e5020103292cb99

  • SHA1

    47cd7b8ffc9015eb7b9b143d10c2c0f119164ce6

  • SHA256

    93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3

  • SHA512

    636f4d8ffb65a71069177d0e5cbb583a53eaa304222340e4f0d57ab88d2645f02e44c6bcdae629bf99a57ff66dea8291f9a7f5d3845aba44ef88e506f5c74fc4

Score
10/10

Malware Config

Extracted

Path

C:\93930f2-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- Dear employees of Lamas Plastics please convey the information below to your superior staff. We're notifying you. We encrypted your data. Maybe you'll say, "It's okay, we'll roll out backups." Take your time! We have upload almost all the data from your main servers, more 800gb information, database. You can contact us for proof. What is critical you of ignoring our message? 1. If you don't write us within the next 10 days, we'll post on our blog, the news that your company has leaked, and then share your files and some of them that have financial value we will sell at our auction. 2. Our blog is read by all world media, as well as law enforcement bodies, in addition we send anonymous letters with proof to your local media What are the consequences if you don't pay? 1. Damage to reputation. 2. Litigation with your customers (most likely it will come out several times more expensive). 3. Law enforcement officers will come to you and seize all the servers and workstations from you to analyze the hack, which will take several months. As a result, you will have to suspend your work. If you have any questions, please contact the link below. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 93930f2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). You must understand, we do not want to do you bad and leave you with a vulnerable system. Our goal is to help you maintain the privacy of your clients and prevent your files from being leaked. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C63670D5028C3C2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/7C63670D5028C3C2 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: LXH7qwxplnN0THGUjNB4YKzXwjzKHOyp4aJjo3W6Opmh8gWfR24A5ou5I1hHToZs 54+l++7UlWpCIKfkSwtufiVCAINp91X494QTiO9ZrHfVPvEcDznWRsu+B3wy0PNO FIdo15dNn1+S53Ek+FtnJFc/sU9yhA1HeYyxy6slT/crlRlOxgkZrkuOIiDjDOk8 rjUMefd6+ULdDnlplL2i9NqQdYYVPkTOJQgleDrjXQ999RI9JEI8KE+gFGeLhC+5 W3RHVP+UlIIWs+HkQBnUbZEOonTXldF3P5doBpbI01RFqeM01x6FZKTjsx2k+/UV NdcYUlAD9bSqAW/RmQfEjPDKtf1B+zddWsvfpBJkcqrc1km7sRVIm89KfEy85xJ2 s0vz0fOvMCif6nkCLjBc6iMHCSLeC3mtrZXoqV+HwRuzhfYRL6tNfJRfqRLkGpAM A73TcVQ405mEo7zXCQBbqgF4PO2aVsoqDNAKOwLqCwxuxLisduq11kJ79HIu3g2F FEKXvPZMX9V4a8w929/ISTZPYJIk9th2+Y9MTeoItar8P10BPynbzmgGG3GFxoNg R+eoSKdU88sa6Fy0Tx4N3yNZ48WoSMF8lACJXaTvyPHyaec8s+GpuO7PEQbTkKvE 1ToTSjTu0S3JsGFtau5pbpiKusyLGdLu1gYTEc0jjEpS/OuBm98RE2P4yDsjftAt ozmzOqOJXb246HlS76y5KDid6dnS2UFHX+8N2tAiEZkUuL14Jq/RCjdspihFNw2I jmIMpF86003qL3jWWbRZRuAkFymRYXdmd9hNWmiv9lDIxq090/TQZoL5ZzPiThAz h+RFKSyU2SSvTvMsglXtd8Yx5Ylj8Me8YUIMli+i0oEyU5ztBpaS/Vb2XDooLRNo mc+zqL1eqh07p025lGhu+x86+43qykc6tRIfNVixJkrNaMJ6ODtHyVo54GqpQ5IS U8zZhNC6l123mYoTdBrihfW5dxYl/qtamATo/DNKuYNlZsHBlL+jRK04xrBYuGtk pCigOyKzM7ofGE1a7eYdbtkPZzsHo2ydhn5GbIFKWAmnIjCfOJ23fAvfhjl5YZb9 PYu33oNn9Vj9+q3WlTa5lnW5vyH1mntmpvNr3TusPctJ1gPeOFRJJ4QSNP3V6OPt f1t74HYodeIELxrFEJkpo4FjIrPksURF0tvY4tqc7dCMYRkWvjTHJ6xRbI1hgaZQ PoGj0BrsatOivWcB38sDiUtm1SwsMES10cXRrczTjDrqm8KYFfVIIEji5Xic3ErG vgkxVIxyQsmpPxlCRgNisg== Extension name: 93930f2 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7C63670D5028C3C2

http://decoder.re/7C63670D5028C3C2

https://filehippo.com/download_tor_browser_for_windows/

Extracted

Path

C:\y720983ua3-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- Dear employees of Lamas Plastics please convey the information below to your superior staff. We're notifying you. We encrypted your data. Maybe you'll say, "It's okay, we'll roll out backups." Take your time! We have upload almost all the data from your main servers, more 800gb information, database. You can contact us for proof. What is critical you of ignoring our message? 1. If you don't write us within the next 10 days, we'll post on our blog, the news that your company has leaked, and then share your files and some of them that have financial value we will sell at our auction. 2. Our blog is read by all world media, as well as law enforcement bodies, in addition we send anonymous letters with proof to your local media What are the consequences if you don't pay? 1. Damage to reputation. 2. Litigation with your customers (most likely it will come out several times more expensive). 3. Law enforcement officers will come to you and seize all the servers and workstations from you to analyze the hack, which will take several months. As a result, you will have to suspend your work. If you have any questions, please contact the link below. [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension y720983ua3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). You must understand, we do not want to do you bad and leave you with a vulnerable system. Our goal is to help you maintain the privacy of your clients and prevent your files from being leaked. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E484F7682B03FDF6 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E484F7682B03FDF6 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: +zAh1TFlmnSgAsYINw5cFEV9VOZkhF6HEbGv2qjN1s/B7bq4WeJ+5BZgSs5/M4RP 6tn205ZLmCGWd5DecTH+piiKFIUcK7CQOZzzv6pkdEnuUgWdrsCqJq/mo5E3YO91 aCTr7EivFtugDFIX04+gjB66GQPqgC6hXz82NK/S1JcKVeVF8YjzUJ4AKgGK1788 6jLdAyJCpl7E2tC3BvjVC7rcodx/1vjOc4eDm8qpzAyeDmDvH+ZLR4VuenBE102b 14AnlsaI51oMTn+eJHFagBE+x3tGpu4P5x0QMUKfI5z12c6tAvxQdZfljIPhFSKa d/AkfbDRg2JvNr+yrABOYd0Yeu3isqMFJl/fuzLPGlHrBxHwLPvgduxNmR4AhyPN uKxesTpPVg3C29cPSUDpr+RWUNs1wctwC22bEJEisPT1DeBEACslBuvHbd6QDTjm 5yEU0LBUDjJSoKNxybCaNROb/DTA+NJ2c4umgQjRgZejCiBNn1D6EYtEzyHVplg7 PtgTYm7Em0EN12Wvb/nGh1558GpowQjRyAPWCBSi/wr2OxpKVvUmEr2NU2VInOjk wFk6wlA6MfctqRCd4IgnCZrfqcfTpTtZ/0uTBfeQHbwRlhDbag8S73wWbueyBRd1 fYshnzFtHEseEL7QzeiocNnoitZ6OtcZyhLi8aYyUwjJhtNMGYZ5ijSHXv0vy46e JQ6XEYuCiuE9vraQKTaXIh17Oj/8qAR1/pP5vqL+NBjYV3eb52wUlVTUlDqTVGIo 8Qhd1vxJEc1HTCe1pI7OAZdq6imev+NxaeJT1X5TDxQWmnDM5QkK0iCINpOfbcK4 CzmuFScmFa+lNlUOUCgGAc+AViU7IRM9KyUUwENxgDEIcNueeX7l/Vi6oVCuM98t Gm0kwCAJ2nuMCEnTqHUUMaCi3zxnX+OYbrBYuP85CSYKeiKB2R8DqALZvJJ4o/JZ +1fR/4VypG9j+FGsqymmLs4w5dBBoMj1Xiz6CyoIfFJwep1FPQRr0LO+bOKOc94S nwSLTYph5OpcCRyH4IH6HngMoIeUIHtkF0pSDiyJiSFEF9S32Xd70tnB8yNOqVLg 3ozSCH9rKtHCJ8VaOuz+NLvxI0D9XlqGExcUX5rGr53HpIzix76TRvMkjYS1DhQN frwg1RtXsbhxFkL6mUt5rX5zio3bQ9D4X/2ZH6QEY3grt0resk92E494z7KA+e2X NtSd6QmwoTucukYwbF95Vh4G2zAyt/sRQerSBrDv7aJRjg7oArc3IPQC4oWaO2si xQX215vDAfsaQAHMF70= Extension name: y720983ua3 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E484F7682B03FDF6

http://decoder.re/E484F7682B03FDF6

https://filehippo.com/download_tor_browser_for_windows/

Targets

    • Target

      93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3

    • Size

      122KB

    • MD5

      6d5e018e9de53f8c7e5020103292cb99

    • SHA1

      47cd7b8ffc9015eb7b9b143d10c2c0f119164ce6

    • SHA256

      93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3

    • SHA512

      636f4d8ffb65a71069177d0e5cbb583a53eaa304222340e4f0d57ab88d2645f02e44c6bcdae629bf99a57ff66dea8291f9a7f5d3845aba44ef88e506f5c74fc4

    Score
    10/10
    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Defacement

1
T1491

Tasks