General

  • Target

    0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc

  • Size

    165KB

  • Sample

    220124-c19h6sadf6

  • MD5

    7b4d9d0a46485dbcaa88c16b8053a30d

  • SHA1

    6775e764a7aa1c766fd71bd6997fcb372db3a618

  • SHA256

    0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc

  • SHA512

    9f6822984883e6f8008b2d549a15ba16f8756fff6a965bfa54f285b09219e366564421d5e252318ae76ac7302e704d5945323e55955035b751c45904da719ac0

Malware Config

Extracted

Family

sodinokibi

Botnet

48

Campaign

2743

C2

bagaholics.in

ygallerysalonsoho.com:443

tweedekansenloket.nl

haus-landliebe.de

renehartman.nl

fascaonline.com

solutionshosting.co.uk

nvisionsigns.com

haard-totaal.nl

profibersan.com

ledyoucan.com

chinowarehousespace.com

pharmeko-group.com

salonlamar.nl

condormobile.fr

testitjavertailut.net

welovecustomers.fr

dayenne-styling.nl

bcabattoirs.org

avisioninthedesert.com

Attributes
  • net

    false

  • pid

    48

  • prc

    ocssd

    firefox

    powerpnt

    oracle

    steam

    onenote

    tbirdconfig

    visio

    mspub

    sql

    encsvc

    isqlplussvc

    ocomm

    dbsnmp

    msaccess

    wordpad

    synctime

    mydesktopqos

    winword

    sqbcoreservice

    dbeng50

    thebat

    excel

    outlook

    xfssvccon

    agntsvc

    thunderbird

    infopath

    mydesktopservice

    ocautoupds

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2743

  • svc

    sql

    vss

    svc$

    mepocs

    backup

    veeam

    sophos

    memtas

Extracted

Path

C:\4l123t81-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4l123t81. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/834F1DD5311B2208 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/834F1DD5311B2208 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: O0y7fzaZO/5H943OyR7oXEqKdFTxP2RYyl+AxfVCsNCmIFxaVqJb3z/xTFDcyCw9 pcUkiJubRrn4b2CcAc+hKTg2QrlZPoGiOq04w7J1c7PH4SEMcY3kKgNAeMGaYS5d hmYWzN/mhuXyaH3UBj0ce96kTYC2gxmQ0S4zSoniGS2aUjwsSo6S2GXipJA+xZP2 syIZSfKMMczsKDGn7wkGjV3FtR81SDHIbM/645BPXjvtRf6NFZTd/GB0mNOFXLkS KVNM5fvnjxZizL4wDkWnqhBCtgXsJR0oyt+DCYzUK2n41HCGG7eKgPVuta5hEGJt ktKrrb7nOCoLw+BiB9R6lwKV9UvmLvCnuTLxioR+f1zPHN09wz6nKB0i3TDBGhdh gaUyGl7fmWYproZDxOSdr/ErPuNxCWygqrIW5bkqUB5vE4UyYzFWrdnumoI4d+Md D4s+1ssVfLCaWUkOvffThOJJNbaspLFIJ74VAClNsnRG46oUBxR8B/hCXcQNCSPt IdnMfnFvBAiseXQxHCoRtNVVCv9ArsSNITVdQMAD55lIuHqQ2NVSER5QTUaYBSJv d4nQavfUuhALx3Whu+OHEQQ+y5mloaqHC4AbNgpKJaq049eRP2whm5kqRYxvYq66 zaFtTpi/kZmLenD53iivTDi9JRN02nptgmDmbhg+cdP91Q752QgAFVX6Mjtl/iN8 bUdKbGZJTLqqBgZFTsVM/yVkQFQytpZ80XDOkUyd30ibcv7Zm5s3SJ6FZ639YOMI nagLhXDdPesaHbKYoedwSQNh7SYhmvDuFgTIygYDw2H8cmt218wiC5l/O9JExcYq U+OxXmDiNJpZmGGCGlkYT25nVSr6KMjMd2gtON8I49EY2PA/QX7Rd5nhmhEc/G6Q 1lKXQ2FRaynkwrSrvbW4T6gvsdirDyA+/8QWO6W0dvEBEPXxpnllZFWNsPXwACrj 33oOGTv4RDWqHIgYGWPlQ1owxFe0QEwmin2zWJZ9/HzXMp/43ewriJFdSTTgdNPk cRQvQm7QGPRygZzDRyY+CYS7doTACqUY7lC6YXFup6DpIxOQzRpTt+N+3tII22/D LL98aigdi2vWJwFcI4qZbuAMtYeTqChraYUtJFhoM8e2doFM2/uC5ynfj/habmIP GW24T2NcPe0= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/834F1DD5311B2208

http://decryptor.top/834F1DD5311B2208

Extracted

Path

C:\122c9xk43-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 122c9xk43. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/53664A3AFCCE2972 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/53664A3AFCCE2972 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TR4hpx+ZmSZtxatuAQZVM19J0h4cRFL4IGPe6Piyu5Q0TeeFBUELh+sw+lUUCfoF 9JpuEXb/a3UtY+YYpOvjBvDgmTQxNOZKSrVMssfvt58iFBvlL7Vd6N3Vux6GdSDn gCgZrl5hNGPU+hQj3xMUVEyX16y8DlvQDrx5haCNOrcrlpRDNEEAW0eogTHR0PGb e6Htnx2hJg4JwRqTiV/reR380VKAnh4dRFOTZfjYFe8Njl9inHvhdbwcXCLZ+AxH Hs0k1xqOZvfPNW3zRpxYNe9PvHFEJ9Q5n7+FPpATeor9+/B0GNRNTMbeb/8pGGf1 cDTMr2MrCBfatVNRhV6vZ8kslqn+M5DHInqrcKBkTTv/LcrZwB6p+vy+yr2U7fgO s2P/Y4h7/yj9/VER7scAncEd/Qbqc8angt6QewWPj+wJOlLDnICGK9eJ56gAfpfM kS4FDbfHm1D50Fhyic5CJP7Pu10PBHMzfRbmdls44gQc3pz80G41ijCIqOZOAeU5 eo2TgTWhSHXN7mmoicrzehDd7zdD7WIwEFJIf5007Pi9bBpC4++j5izaIr9m93XW OFUEEAcSzybog8w9kYU4qHwUR9yLX8vlRzkhRB6Wav3ZEqN2llf7Qc6X7pdd0t6H b9nQ1n8lbDXnWL/aYCgBfHMGCRdvtNV8Cg6RcdhooesFa1gjdrGU2tUii1OEm/FI IgpmvVpxzAXf7ua1rWaY6VWnusg+JW7nzO8YgeIYvKbrZfZJbNjP22BcldV61McT XsU45bXaLG8w9YXZZpGE2T/xLi9V6o0NvbDefS5QY4OjqAqC7ueA9SRxhOWibAok x2TpGUE8HqNy5QeJIhV0TzLNU/UTG+WJsi6wgV52lc/9rOGyZarqP/UbQHqk8VBV Fa+PulCP9bD/y0a276JV8ZF1GRmOuvbLAnq7zXoE503BiaFFAEePOHTnoGAJN/RW GCw3uxAFDCgqvC5pLffjlJTFEjgBSTO6gzn2VDNgPt4VclMcxl4CvNle4G05++M4 XrAomjh9f4u7xdW2MIzLkkatR5QpDjUIZgJ8k+jESzUWew4oZ2i7MUbJTy5jKqSh czxpHDRbF8OhLhHb6FrKv9Z5PWlwa1d0VRqu0xcIazqI6Ul0EpB+Cnt/I+1pSMvO o8Q= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/53664A3AFCCE2972

http://decryptor.top/53664A3AFCCE2972

Targets

    • Target

      0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc

    • Size

      165KB

    • MD5

      7b4d9d0a46485dbcaa88c16b8053a30d

    • SHA1

      6775e764a7aa1c766fd71bd6997fcb372db3a618

    • SHA256

      0bc595b769a9e4a9a72046b2d07e5e157d179bbed997ceb237d805f90f67c1fc

    • SHA512

      9f6822984883e6f8008b2d549a15ba16f8756fff6a965bfa54f285b09219e366564421d5e252318ae76ac7302e704d5945323e55955035b751c45904da719ac0

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks