General

  • Target

    0d0852f1150ea56f7baf104c15f56eed44b3e48a9d77d599a681ddbf11e7e1b4

  • Size

    136KB

  • Sample

    220124-c1yfxaaebq

  • MD5

    a620f7f13bab3c0f5f5c845e7187a1fa

  • SHA1

    d0fddf7760803971dcb79f787dc5f7906723ac81

  • SHA256

    0d0852f1150ea56f7baf104c15f56eed44b3e48a9d77d599a681ddbf11e7e1b4

  • SHA512

    9ef35102599d052f431740f8c5d29e81a56be67598a2c748bfff0b8d514da79e04ebb89d1ce728c529ba778ce8239758896a2bb9e561140df0c0412382d005e1

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

Campaign

1428

C2

ecpmedia.vn

triactis.com

promalaga.es

siliconbeach-realestate.com

bigbaguettes.eu

web.ion.ag

spacecitysisters.org

abogadosaccidentetraficosevilla.es

blacksirius.de

sipstroysochi.ru

foryourhealth.live

schraven.de

mardenherefordshire-pc.gov.uk

pubweb.carnet.hr

joyeriaorindia.com

makeflowers.ru

seevilla-dr-sturm.at

podsosnami.ru

stupbratt.no

jsfg.com

Attributes
  • net

    true

  • pid

    $2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

  • prc

    sqlservr

    excel

    sqbcoreservice

    powerpnt

    mydesktopservice

    dbsnmp

    msftesql

    steam

    sqlbrowser

    ocautoupds

    visio

    sqlagent

    thebat64

    outlook

    dbeng50

    mydesktopqos

    onenote

    sqlwriter

    tbirdconfig

    agntsvc

    infopath

    encsvc

    oracle

    synctime

    mysqld_nt

    thebat

    xfssvccon

    isqlplussvc

    wordpad

    mspub

    ocomm

    firefoxconfig

    msaccess

    winword

    mysqld

    mysqld_opt

    ocssd

    thunderbird

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    memtas

    veeam

    sophos

    vss

    svc$

    sql

    mepocs

    backup

Extracted

Path

C:\i36oag493-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion i36oag493. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3AF3A7E6D198D4A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F3AF3A7E6D198D4A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dYIVL3viRN72LxUMWK7bh+f1YN8jV+VX/VAyHOTXDwjFEVBNtOJI5vd5DqkkJJa0 0Tzjd8elyEVZA/XuHWYR3b8as76eT8zdfqsUWdaQRSde1YUuX5B1zQBCkRwmmmTS Tbgz2OyXC+rZVJX4Dnu0qOJqwwZL82gOmS02Cbs5fdRIy6NKsF/GzqsE5myFRbTI Y400efxu6/djQJPrGP8BOMbrbE+cUURwlxGOdXIxCPuYaS9UnYBf+elWMm3HvUaQ DobKHHvjzQYAZSY4XSVcID8vlPh4FJaomDvaya3qekOl6aAv+ckIh1mHBiqyv15p OA+oA4PHZOVvtJeSZn+JzWf+6veP1dwGl2rflhv0T8ia5mMmSRlG3PINUdQyoYPS mgW7pcjJg7kE7hvN3Qxxxcu+e3KOnUhuaxK2ZjhQbBV2+PXUe6LAXnZ4UEs4wv8J 08lIwvY6cJYGKJCpDXaGyS/nYHpyholunFJeuV68bmg+omM35IB8lErHJMS/9XEf rDGCy7VMO+3e5F4x4Pywwc/z7+9CttMpYqsLMQmj34vGXAsCDH5Z+UZYXHSu0X0g wHGlxN5Xoynz1yXxZArRSN3TeuPR1JImscVVN/GLZEK7U6bzqyyK1E/pZwowx1y1 VkWe3e4DJdQpTELFxkzwhfSzEKxt3qaxrmZoGOF6LZ44O8x2Mn6YxITY9/p23jjV z98vL0NcXvnX1tICPFvkNRoNGwcrcHvjBWGlQ6HV9ZxV4fxGbGv2gQRCa8b5RDU2 QUFVViHdsWA32RGtVp7HtV7T8DOgVUqy6oblkhTGNbVwUevLHTffZzBQaJ1s0EFy nUQJ4URLOAL08jyH+JYcHqUJhuGpb2r7nGGPaU7ilvtV6iV9rSo5AtCnBi2ImK/o ELiLrlt35vIAsIB7cqfmQ4RqsoPOOv/IOdaPDJaQjlq9H67e9o4FKG5JLeu3Deuf 7yfi+tx33QEYHIieZJgInVqhSEH0jo5Tp5yVnp52nmiKoJ05ereWsBWp+e3bjxFt PxJtYU9CuBauieHAVsGyCktPOs5h69PN7BYuxfdTs3bZvYq5n/RabE4SCTEoxP5c I7n0ki2LSPGy4AcXhlSov9Z4ACP1QOW+c11gCYPjEjF13k1I0V4wvSFLH8egGc7f TebnDj6e7tb89o9s0jngBSHkEtqbCLdwsv/5sfkhBWgGGoi/pZ9Ab3ZaQhJPbOmk tVauD2T5/PAyAFI/bOmUU2dQmxzZPOh0HprIwL7h3j/YbsCtwJ24JLhMUPvg6Ayk FGDiuswqrWTtFLi+mCOknNsIznYPhIeMjnmG/i9m Extension name: i36oag493 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F3AF3A7E6D198D4A

http://decryptor.cc/F3AF3A7E6D198D4A

Extracted

Path

C:\8jy0k5-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 8jy0k5. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECB50E9F7B4C7C79 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/ECB50E9F7B4C7C79 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3Z1gZGpek6/BPsQNl7t1YX5etg2giQckHSkFA2HAeCLQk1HbH2BjgmnOpq/ubeXV HHpJvqobzqtm2sCdwJuvdNF+w3nYs6IevYZemiacNoIXwI+PQuhzY8pFPUfKf9iJ lLc+RmKjq0q1lHPOAe2jTrxj4L4b4F5KlqzFiEAMSQWCNWguyOKCN7hjIXBg1p1O oHhQf+gE8uVOfXOSDONgd3Y4z7kJQ4mztPSLzSLHzfpKGLvEU7ol5iBGkG9HC/Ll yq1xIFx3LaZVxgCROgsjapS+Ski/0x7eaTAOUza4sJ9E+3bb1dNZT+nDQ1F9/SwI WmZph8MUlUMAaHBIsJ/cpLU4YsFxo7jB7y2r7BBa+yqeP2o1iaUZ1csZDGjhryqd GlfqkW4xie9PbQjZwp3m0aXqiSybIzf8Bbg1aA0p+dYPI8g3a0xj7UujKcxJnygn eXrstYPXXqBF0R/dhYOBLPhgo7gnwKNUsGQi19Devp0uFcCsi7+o/a+iBkFajEup FABCCPOmHJIFBfU3yjTmjtwZGFZNpEuOHSNV9/Xi9sktOPENrA+moAqBOtP37Xmg w7Z7iwW2Q0BpQIREXSOPFK+eJG3GsvwW5lZzTn7IaJ5gENjyOZ9m+6bleRPyn1cs c+2oAGMssiozfCYRTDX0lnoeypfRhiPK/hF62WA4gj7Z6TYZCezzrdclmKhLE239 Ze87kzJ/9VAwxA3mPo1uJGyaalG51zIplexbFwLQzpu5wfjLrTGZQSpw918JEfRl Hai5APZrX5LNWrvy5mNH9WBCBkDhFRPjbliw/J+qTa0LUV2fsDSAaO29K3/bhrxs Owh8lBju+Zbtv2YDlzuA+Um28dT7IvqlMHk2rqvXGDdhwK57kpf696d/hwM0fff3 7tWuLXKxeR4SinLsFPNcDmiIrSgoFxIlt2h+W5GxJ8QuJTmXjs5589CsmLloYn5y DGJhUqd08K66VHUNBrOBBcyTJh9n2mhLfAYa8xv/KrvS86/8LHCV+03JmInAcog4 A9/hu0klcXfTIWb7NPWzy1nZRacTyQhoKyWNhXUECe31gk5JMAvX5rL/avL7WEph FVVKydVF4sEfmLpJPovGbyIOAkG6Z5jqANejv9Ywli86T+fG9lKEsaJEUFGEtFt4 qCLzQK29Xv6IEEOcuEgdLwM9wxSIZcYdRkoQHaRXR5CvR5J1Esk3dhiuMhD625H9 ZHjgp2DEOhYRNc8Qc0SP69ORFKm948369Xmjzn85m4iQOS1VtXRxwTW25hw5/dlH 4aHUJi2nSVHBEaHASbtLvA== Extension name: 8jy0k5 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ECB50E9F7B4C7C79

http://decryptor.cc/ECB50E9F7B4C7C79

Targets

    • Target

      0d0852f1150ea56f7baf104c15f56eed44b3e48a9d77d599a681ddbf11e7e1b4

    • Size

      136KB

    • MD5

      a620f7f13bab3c0f5f5c845e7187a1fa

    • SHA1

      d0fddf7760803971dcb79f787dc5f7906723ac81

    • SHA256

      0d0852f1150ea56f7baf104c15f56eed44b3e48a9d77d599a681ddbf11e7e1b4

    • SHA512

      9ef35102599d052f431740f8c5d29e81a56be67598a2c748bfff0b8d514da79e04ebb89d1ce728c529ba778ce8239758896a2bb9e561140df0c0412382d005e1

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks