General

  • Target

    67a1130899695f2a2afa490ac62d6641c6bf0dc5dd3a63e786e806454214f36f

  • Size

    178KB

  • Sample

    220124-cbwk1shhdk

  • MD5

    8c1561ca54045cb6934c62711e16e6fe

  • SHA1

    6708d111176432e753f3564b2ad7c0233408d739

  • SHA256

    67a1130899695f2a2afa490ac62d6641c6bf0dc5dd3a63e786e806454214f36f

  • SHA512

    58951d028c7c7acfe8f5c5936b625e2f49bda8455d25da9fd446bfa016b5501ea5d29de323d9dee179bcdc2dd75d9e1b78fd489c9b9fc965de35862535b883ca

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

35

C2

ufovidmag.com

daveystownhouse.com

profibersan.com

trivselsguide.dk

achetrabalhos.com

centuryvisionglobal.com

zaczytana.com

putzen-reinigen.com

maryairbnb.wordpress.com

ncn.nl

utilisacteur.fr

vdolg24.online

livelai.com

opticahubertruiz.com

brisbaneosteopathic.com.au

liepertgrafikweb.at

lifeinbreaths.com

ronielyn.com

ultimatelifesource.com

markseymourphotography.co.uk

Attributes
  • net

    true

  • pid

    19

  • prc

    infopath

    isqlplussvc

    mysqld_opt

    msftesql

    mydesktopservice

    sqbcoreservice

    ocautoupds

    ocssd

    mspub

    dbsnmp

    thunderbird

    mysqld

    oracle

    thebat

    sqlagent

    tbirdconfig

    mydesktopqos

    wordpad

    firefoxconfig

    winword

    onenote

    sqlwriter

    xfssvccon

    ocomm

    outlook

    synctime

    sqlbrowser

    visio

    mysqld_nt

    msaccess

    powerpnt

    encsvc

    steam

    thebat64

    excel

    dbeng50

    sqlservr

    agntsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    35

  • svc

    backup

    memtas

    vss

    sophos

    sql

    mepocs

    svc$

    veeam

Extracted

Path

C:\13ul8rej9s-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 13ul8rej9s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/96EDE2EFBF8AC568 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/96EDE2EFBF8AC568 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +8OpNjBbM9U5Nb6SBEud/inuycYTnzKMIMMi2LT+FhOb+KSq7oSrokHtx8RbEgRV q9erIkLYogH0j70o1JNplYwJuaXgJDIw85ASoUOQLiBx+Mt5CxZEA79nCCu1Pd+Y WLQ7Q7EfPIyaW/jpudkUL1sX/Lg5fJT+7JNVVbeqXUpjZMnmTBg8dsbPQjT55TNi FvXK4XqYcMDYdApKpQIqmE3+KWhTciisTvCn4Ajz1aAR0whlr2d7EeaphH9m25Jj LxbZ74Ybu1iSUoa61a7oYiisFkZdCWA1QgIvfBa+fHy5KgmcFoaeicoGmPp128aD pkl0vOCkAkZ+3LQO4lt8HAvKQZ1LUPwjgmAHTjTvVTOamhcu0MXwRwPAIzwd31qX PqaByQqJtwrpi1HIDeST8Q/h2HGu5AioDCT3n/YHJWZrWttcoBFny7kPzZap2k62 QvGxALO8+mbTR+Rkn2IBtFNiykzqhcubr9bXPxPaz0ws5mPtgosR1pSZtfImS/vC sTzw91/tuoJCAtHPAB9skMWnFYgVZOPKFIm1ZoktodQkkcERQSQTHCdk3hUNvn59 IpBxg26yV+Fqc2voksfC2TeY7MM7xdUkNswoTpoiHfRBDGDZBNcTAUaPvqMYZTi3 YeR1tEghaA+xlj4jXcaykgJUZiQDK4+EbltUBJR1G8mnKGCXIkhekbLHtfBmMnSE tsRYSrO47KFAbWEsayiJB/uTA73tSBvwH2wtfxfhNal83ZFslfEI190vmQplW7iT KCc+1GbXfVst000Kh1x9gH/nyEwYwEIVoVdjBSIJcNn3C9uWMnjeI/nhxzo3oHfY XF5RwKPkJyHIcQXON+mFaG3jFrRtTdxkOVeBYoEx6hutn4qj2v7hmPeEYcjBdzp2 LP+7IWX3Oox5ji/MYBVkYpogX/XKw35q2eFqF/MP2U74PV9EJSmfX6JxuYRGKKtZ fvDCSg7PFuU1p0Ycyrmp21booDx6jMcl96t3obgtFwWphz1IMvdVl5iTuGQVUh3W Iohel6SP72zqqXYVCFi0KcpL2qyDJNHIOokNYy8mIg4sNqFJNVi+AUsqXTcoIhP9 jG2wKfXtXN6WYOw6TShcRu8D2iT3xmwaom6/4nTITe6c8LMZDOOLOJ9cxc7qu8hm 6ymREHxBGgM= Extension name: 13ul8rej9s ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/96EDE2EFBF8AC568

http://decryptor.top/96EDE2EFBF8AC568

Extracted

Path

C:\4k2z6xja0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4k2z6xja0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C6B7CDA3605C612B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/C6B7CDA3605C612B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: saZmUbJ/r0b4pK4YeOPHdM+VH2dJGiHlHgsjS5IeaLN4B/wz/7RGaAiHne0Ts38r Yph0klKDfl7gz5D3kCVc9sRWU6nA/R3mWl+3maPe3guYi32YHKZSTcJnbeQEeZcr a00G6KDyJo8A7Pb1txDE3ktG5qIY1HossSmMcD3vU+eHdzkpKg7KrNv2tW3vYxbs uUh5YhKPlmmc/nrJsvJ9VO4fydwWNXF87ezkuIdcPSeLmgycX8ycV01WsxJz2DY9 joKliyHzym/3HQ2/6CazDE17d7qUDUv1QbSTKtQZyaZUI0r35aPN/DkjCYUbccvx NE0JCRh9mvhQENEc7PRmy5ZFSUbs3qdmU3lJr2M1F+fa0cLijoUaJaLwmoXZ8wlq IrzKTky6ES1MaWKxzJZ9fvrVO6pj5vDxC7mI75+YAhG+Uk/9Cdx8xh1dmxzZ9GHj iV8lZ08NpJIA/5fvoWErfIixRUwe7oXu15horhj8JwqGO1GdU+r06RNB8EiyjJIG kVMc78nHpKf72RnaBZss1qykMnoRMaEHg4OuKQZvvyQ9iM87nWv/63C9sU1k3YV6 Dvpvk34n/v4Q1ccq3UUr3F3qh57EqhAg2OVAT6g+jaxXsMHjYDK0x+vpPKK5I8aF ZAMCXFl/W0KXF5+OECJw/DRqg6a4wqIH1Mm8c0b6Nz7rl70OzURSOA6AfQHgz5dW h9g7AO35LSI0KiF6MUeSFe92uLKmbOGH1fH3n8J9kUDk8UG2zdcAbP+V7uphkqdp +JmzN1kRcQDxsNwmhJ/pbdWTgvvLCIa1Bt+C8oMZxv8SLqXcMFXlIUPJ8Gwjt5WU iPUFPaZwvfOhL0gmPH6eCiRKUXE6rV1RlRq4ef0m1japNM7LoduarL7S2CbgcRox R9a7kqrEJUGfLC4yZ4JRUQ9XIlyCe4QofeMJFVS8yMco/Yazvxc4Kejqwrp6j6hx m89jxqAx47ACVcBLY3sbcvpttrIyB7o69QbVZnVYy9zSUE7DArqGmd2/jBU/PFv3 EB3vfig7n8+8nwoX9gGsG5H7BYDV9wutC5kTHNyJkhB4h2Lzb4w6ZzGue7XyCWmm I5/k6YW9MMzhZKnf10tn22/esS1/ub6PZz9cVZbUSPmh7wnL31opl77qaM+3wA== Extension name: 4k2z6xja0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C6B7CDA3605C612B

http://decryptor.top/C6B7CDA3605C612B

Targets

    • Target

      67a1130899695f2a2afa490ac62d6641c6bf0dc5dd3a63e786e806454214f36f

    • Size

      178KB

    • MD5

      8c1561ca54045cb6934c62711e16e6fe

    • SHA1

      6708d111176432e753f3564b2ad7c0233408d739

    • SHA256

      67a1130899695f2a2afa490ac62d6641c6bf0dc5dd3a63e786e806454214f36f

    • SHA512

      58951d028c7c7acfe8f5c5936b625e2f49bda8455d25da9fd446bfa016b5501ea5d29de323d9dee179bcdc2dd75d9e1b78fd489c9b9fc965de35862535b883ca

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks