General

  • Target

    92639fcebdeb5983b6b87cb523cdd73b2111945e5d242aa8654e8a48c9e86319

  • Size

    4.2MB

  • Sample

    220124-bzg7vshehp

  • MD5

    7649feac35d38df3db40235c76c34d30

  • SHA1

    5ebfaa9e4fe873062dc4c6182cf4a40939d1e7ae

  • SHA256

    92639fcebdeb5983b6b87cb523cdd73b2111945e5d242aa8654e8a48c9e86319

  • SHA512

    3b62a662e8e1529a63587604d1d4d14cebacb6ab4756136a6c366fe0c5a99fe3b5bcbd210e4e9b4ee660b8adad8034176c19fa96228c0aa2d9a54769ad7d6253

Malware Config

Extracted

Family

sodinokibi

Botnet

38

Campaign

379

C2

noda.com.ua

ijsselbeton.nl

broccolisoep.nl

fsbforsale.com

mrkluttz.com

berdonllp.com

ox-home.com

internalresults.com

kdbrh.com

goddardleadership.org

o2o-academy.com

fbmagazine.ru

toranjtuition.org

site.markkit.com.br

tesisatonarim.com

mundo-pieces-auto.fr

egpu.fr

rossomattonecase.it

fotoeditores.com

awaisghauri.com

Attributes
  • net

    false

  • pid

    38

  • prc

    winword

    ocssd

    mydesktopservice

    sqlagent

    sqlwriter

    ocomm

    thebat64

    dbsnmp

    msftesql

    mysqld_nt

    sqbcoreservice

    visio

    encsvc

    steam

    sqlbrowser

    tbirdconfig

    mysqld_opt

    mspub

    sqlservr

    ocautoupds

    synctime

    outlook

    agntsvc

    mydesktopqos

    xfssvccon

    onenote

    thunderbird

    powerpnt

    mysqld

    isqlplussvc

    firefoxconfig

    infopath

    wordpad

    excel

    msaccess

    thebat

    dbeng50

    oracle

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    379

  • svc

    svc$

    veeam

    memtas

    mepocs

    backup

    sophos

    sql

    vss

Extracted

Path

C:\tuc3e950sv-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion tuc3e950sv. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AF05A9926DCC50E3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/AF05A9926DCC50E3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8/W77YHE24QOdQ4bXZxQRIrpBOlVIl+w4x2L7oL59PkTJjL2tCB061MlrG43IqI5 ZklVBhpa/VpCWNXPG1/XJqCCrOFCeMKVW0k+Mp/IMtdeVEhFfpCyPXo/7Cy8OXLf sKGWZmLWS4iHQd9mWnXMZ0TkM8oT2xqvyYrWHf/oy0DXYIjvYvpbcCkroYkey4qQ FvGsLvWuyjYkd0a/Q0caWrI/lvozoZqAtt0+19xvWjKjzauFO7novFauqpzmDPmN 4bo2XuwHaDJFuXaW68ECD/iPISZzX7UP4rOyRjZQiSp7FLneYLeORVlOJQnqc/5t qgsVMAmcjFUZWG4CDXGYP8vik92F+PSsgGHoZ82i2iL/8pvRmK2rL07lK74LTYyD mmPNPEPBqrCnqj8q5LCB1saLssOwq/MRHf4pY79Ta54UJqSMX1q8e3CQEv2SxoZt kLY9lQJR7d/aYSxNhEeK1iCvgluoLKFJUWq+aeFUXYXs8fyhTLZg+CTEi4Hu0nmU 5e7Gz1boobl94nJuhI6vi+OKSSb43DOIXQw8l0ofjKxdj2t2bw0zpiDHIS2pbSL+ iUO8xnAQyjMNTAs8ngUzDsf+rwxZVoYOGDelNLKA/ZY57hFwcFMSIHGzU3JKM21I SkV+9u0MvNsoz0zCjdSLlycv5buzJFifQTCej/E7ywXswm5C+aqcYit3hnadJyrk f4lDlrU9mc1uHwJsZFw2vHZkltnQt2pMbMZSlblS4WmrJVS+zkAEc6Gnz2czkFqA 3NW+WoFEOVVnOueT78m6MLQMomtpg3PHnuPcLtaLBbMWsCVif6QwErZuddxD46q2 ZadAR3Uo+Jlp6rwT+VYppu6K44TJPdl/4/vW/s+mqTWLoLH5IZ2ZGFmSz4ugCha5 agsr3Sx7QMiEBehcqvcKISc1er1CnoWX5wG2WTAnLu5Mk7OuQZEd9MEghqwNn8QC fQvAhe0gybtDsns3F8QK3XJ/WZ+7JJ/iynC+02Vt7roREK1G6FONK27o4ybtJMV/ ReGozgm6QN483wAWKM7bLlPPS9gBcEmqN5aQ045Aus4AqNVK6y9iyK8U+epMCTWQ wJ3KX9I+df7rqtMtONu9aU4BHoqiClNmGYJTtGfoSDVq/itXZjhzMAJSTJLERHi0 Iax5TN5z1LqSCw== Extension name: tuc3e950sv ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AF05A9926DCC50E3

http://decryptor.top/AF05A9926DCC50E3

Extracted

Path

C:\h44bl4mz-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion h44bl4mz. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/396EAA683980E9D9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/396EAA683980E9D9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: udPdkhsLLKhaplsKSY+9TfOBXb12cwl6rrBI9bixRXSZBnEY/55no8VqJCkcarvs Ki8X9Ps4NrhsFap5QuXr2egv4p1SNcCmmZJq2sR1QwiAYxbzDmn4NWcRDMExgNne ncVzBCOws7BehI4Xf+i76RqIceI+qSbAChhDC+G+opmiAJUJ+deG4ZRjRafK7fRF ztCBpX67mFiIYRadvhgV26QYLmI4s50c7JlXJXtFHqmmAM7hrksb/mUdeyJ0RlJ4 r5ZToQBWyfafm3Y4w5Cv2X62CW7zaCCLinKQqcAB3+4mltOiBAr4Vzb1Tjv16Ln2 sPrvHoMGBqaok1XYO5ImrgxGjSxF6sAwrKJ14lRjzQ5zbiM30DAiQ5OxE+0almop XQWdCX3hX9d8f4pR7TcX4oCJjKKAVHHZOBUu14glTrrDHZyYQIfQ1s15d/VsA0M4 HmrnMfdnQcKbu5u7qsdsG6S91BM4LAwdsyVUWHhxPiwjkjdxxGKKatF6vM9H+7fc TpkfJEgUW16CTnuEXU1seYvBESm0G/2NY41/I9APvOVhnzclbOapAakAm5+32MQ3 MqhiV/L7SClfdr9xvL4aofOYumqqTpat65GDvu4kQb0cnPDW0vSZ9XnlxPeE/gok iZiPV6u2XFlvBhjCf0np6wxln+zEgfKFqNQ6wWBOC9YmWzkLeVfethr/KZnvDz0T gnWNiR05/4EIk3zfCXigkUJNMwYZd43igOhKtVENZx/f7KsJi1k7LlYNr8hYm0Ag vK+7TM4HCzHcO/WQJrNo3Fwy4Eb+Nz/6ZWkH9iCZmQYznqrE6oN8qW4I7l+5Wa1q bSkfgDe7KL9TThyUbX1zgJkS8mMdoXjZ8bCoLaKkpGroZ/H3xfb6+GpOKnAS9Tkx xESpiODzd/ZGt3OIDH8XNqfEc+a4uAJXuPYgcC+QALtxZhGbxtXbZlg7jcmZdpzQ CId4SwPmGY+DBjW3l4NIYlYwpJUVr34rvaSuMy5Qkch1NMCrafQOyEE0so+BkZe1 3MGF2yO7gzD8Its0i8E2FzEj3wygatKpJzsMlKAaM/jgnpSyIUl29cVYFztMjMWw mQvazy+TG6YDICppgLmYENuAeXGRa9CVuHZdmii4C7F27Pn0mwm88HPFpE386w== Extension name: h44bl4mz ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/396EAA683980E9D9

http://decryptor.top/396EAA683980E9D9

Targets

    • Target

      92639fcebdeb5983b6b87cb523cdd73b2111945e5d242aa8654e8a48c9e86319

    • Size

      4.2MB

    • MD5

      7649feac35d38df3db40235c76c34d30

    • SHA1

      5ebfaa9e4fe873062dc4c6182cf4a40939d1e7ae

    • SHA256

      92639fcebdeb5983b6b87cb523cdd73b2111945e5d242aa8654e8a48c9e86319

    • SHA512

      3b62a662e8e1529a63587604d1d4d14cebacb6ab4756136a6c366fe0c5a99fe3b5bcbd210e4e9b4ee660b8adad8034176c19fa96228c0aa2d9a54769ad7d6253

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks