General

  • Target

    629f8b33cc1059573525a2502660f13a529b82a8a315d938d100ed9ba798c7c1

  • Size

    117KB

  • Sample

    220124-cc88haaaa3

  • MD5

    88f4e14594089b7c2cbaae357a2e29e2

  • SHA1

    71a1ad7213291a5a7e5e45fc65000f03f3864f60

  • SHA256

    629f8b33cc1059573525a2502660f13a529b82a8a315d938d100ed9ba798c7c1

  • SHA512

    a31bb82b86eb3076450bbc655fb102dc46f9e11090b834b45b38b570c49dd80592b3bff0c24a46005ae963c7efdc4b79a252454a1d8668c58c86f562100db3c8

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$/8q/XYKCIIP9UnsCILXAj.cB8WjMVsNZfFgDCo1BzaExdCtUadq6O

Campaign

96

C2

coffreo.biz

rushhourappliances.com

denifl-consulting.at

notmissingout.com

extraordinaryoutdoors.com

diversiapsicologia.es

narcert.com

autofolierung-lu.de

reddysbakery.com

moveonnews.com

chrissieperry.com

hexcreatives.co

rocketccw.com

nosuchthingasgovernment.com

appsformacpc.com

basisschooldezonnewijzer.nl

parebrise-tla.fr

bigler-hrconsulting.ch

cnoia.org

gopackapp.com

Attributes
  • net

    true

  • pid

    $2a$10$/8q/XYKCIIP9UnsCILXAj.cB8WjMVsNZfFgDCo1BzaExdCtUadq6O

  • prc

    wordpad

    mspub

    oracle

    powerpnt

    thunderbird

    thebat

    infopath

    mysqld_nt

    dbsnmp

    sqlservr

    steam

    dbeng50

    visio

    mydesktopqos

    isqlplussvc

    mysqld

    sqlagent

    encsvc

    sqlbrowser

    sqlwriter

    synctime

    tbirdconfig

    ocomm

    sqbcoreservice

    thebat64

    winword

    mysqld_opt

    onenote

    outlook

    ocautoupds

    msaccess

    mydesktopservice

    xfssvccon

    ocssd

    msftesql

    excel

    firefoxconfig

    agntsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    96

  • svc

    backup

    sophos

    svc$

    memtas

    sql

    veeam

    mepocs

    vss

Extracted

Path

C:\61p70c-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 61p70c. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C4FEAB8C83DC381F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C4FEAB8C83DC381F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: l+U8fV+OT3PaU1chTG/z66OOEeQqUv1P8cVANul5GEjyf/TUlNe9zFopV+coO8hK xMGeqC/0rf4i01HlZ6ExrS25zABo7AOmGsi8lmtwu+EMEZzZ8EL/XO4iyDQqZGb2 kkduMDVXH1li2C8NLoMfUOoc6xwPAs/ZMc3OlYtCuXglUQiI3KekuCxLbDm7lbY4 AWJl2esVJdhvqjqlgWhDF6KXn02pycT8jX8WoRomDgZUg3dxKHBtgWnwdXEqUmn3 OLF3+Jz03aAgexwl95X03MMbP9NnZpJqAHKvh16tLJGaL+PLLQ4rqREpJ0C4tdAY 8avxvE4uH09efXDDyh5L1qoQTX5FLSkPODRisl0qZXvE7CP3Et8RAcgovSe4vmcw 8rG8joXCGrQc5NEzGKqGj3eNz0R7D7kvK6na254U6pM2YmV+GTucWm9dklHgn4AY zsWa7GAWExKRPt7jGkwI8OGR6/fBbsdHzpvhQNb2iH6uGGHRhNCWgtU8kGj3tyI2 Sot8LWkpHQ9WI2IuvxUVgKH/RtMBlAeGBEuvwSYo+NtfBHXozFDObE9ZPULKYOsu R3pymHFcIwsWQ0hzpaqTxseGj17z90ua6gGRaBHAEhFS0KF6M5rFFFH4eW7YY9KN KoC1UJ2YAnxQCCZzIaAN0s3ZzqpYRWNi4uHyhJXYPxrqHl4QBkXpDHS4bHFhGzA0 xkJPyGZs99kFlWz2yyrVDxuGtAVDfGJwEG3GjSkIiF0rtkJuc17nmF3GXSClYtLH RiJ78Dp7Dkw8qNd6+mo/5pbx3uzAQvfPa/y+Tm3SmjtBpA1uABqgTVpnnFV7nDis m8hgcUoogH+XS2xxljlRmpYtpVOID3gy0ZjjhBG7AtL32JK3RkXoVY3eysg6o02y 4PfssFEZPGZv2zZ7ejxGu42mIFp0aUoF92E86uoG5MM4e4roQiX+ii+4aGWjvDIa 78u89CDyG0NDJkIbtCXfjrm8BVSO6WQnGufewadgm6Ff4Rrg0FyRKCaza9ze90kW QoAXrd+HDpi+gGoWBbirBCH/h3agjuFIZTBD0CrutbyXerjQWihfOyt174epMGkH Galp6l7RY7W/xT0H6ZZIN/FsnuH1b63/WrjNhU8PDQpXcl7k9W4c9IBAk02fi91P LaA3CZByDHf3oHHC/eBgTJOmI5zewAKKsFXIjsJ26l8iOaotJKAgxk0iz5FVpEB0 pwbXiCh0RPUINo3tMIHF4MacNGHYbHbiIP8+IPv8XLRIXwJ7OupuUuvS7MGxh540 VT7y0iEM3UCins54hpd82P1erOY= Extension name: 61p70c ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C4FEAB8C83DC381F

http://decryptor.cc/C4FEAB8C83DC381F

Extracted

Path

C:\247d247l76-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 247d247l76. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0C0C8131993EA795 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0C0C8131993EA795 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ESf7CoNAdnQs3861Cu1fQqd2kTK2GeCLlNDiZHUR8C4lo9jVxpSsoxn657G3mtg0 DYSt5fvpJ5POWDceuCn21Fnq70fGdp0JAVTC70Lv5Wn5LlHy9fYrIkxyUxrYLDxF PkJYSgQOdAA2nVzqpSjtcyreINmFAX7AMcfa0Aa7+vUp+5qPmbXw+8FGDggj0EoB Elr3rkl81vvuJ6uktZau1Cgp0lY4YWeseX8RBq6vH1gfzP8lvQzKMjyaIrJIDVP7 LaAe6EIYqvp8WetAOShPQ52iWdg3LCIbKVvmiVw0ugZZ19xY+iI7GVooyIm+riii qwSIjdeeY2J+P22qt+d/ojeBpk3EY7cWc+u0cvb9KuZFY4s5E/l60/BICPvOttqa z/urKW+TqhktmZSH2wydc84V384v7OholT/kQ7HVt92YkSFdRW/UMfPtCN19r0E+ Ai8Irmx6Q5NeP1+LzkdeYbwmDRrX4+0GyQmSSONJdoRPKUfjrN6TCYkCXN2EL109 BpLcfGyN+We6V3wO6Q9h1vdWwbtwzShOvB+77Z7U9dRoMrtwr02ENb3hAr4x4K+F jzEyYhU8EmRQPnxJkolHlS2V/yz+HMK8jAFrva/48Cr05V0m4XAbsrjyyHi/M2Xv jFtmYgKT0GwrK9w0+ArHZcOlp1gPJ17sig8G+++PZNUC9h0v8fCv2d6TTUKcvdIe CWsZ7dS9Q8fJS6UzypuYLjPtSd0wi6cbJuG5yaxe/gC1tjLM1rlwBE07Pb/F1NhT MDwv0kV8hnaSr8Yk/9ZKFcQwH1cn1C2e9YyVKdLtP1TQl874DN7CFDx2s527OdLI uMYRFOBO7K3uqbv73lG6cQUXBeXREd8AwZ0fy/iGq+WO/YylBuMLxE3opBR7Ml36 GXF1BWlKlBdDs1U40dfX/K+8pICuJbgtuNxj8u35NZaL18iynMPbIvwCyK3ZRLUF LoEP1BEcHrC+dZhhHk98YjdDhy6jAGoZKrbkBxr9HneWoJNc1MMWv36q6lBZtGKe ogsS/hVqeJUa2d8Z23RJZkbqIFA7B18XUz63Q3aNIC4aau8wGKDdQT3xAe0kqfH0 Dox9DNdygKLci2d9ndukAqixsPIamhmSGDXLHe7lWavUwXmqamZatRKjcXnMUdpg SQAkGc6O6VrfM0EIGap4iD907fpw+5VK4yBKp2vrLwLea7groPE2GwEZdWBtMqou 9V2eta8LvFew54pDQU7vN2uPpMR56Bb7POjLZRJKimWfnIJm80T45X0oBmYQXYJP TeHP+eydMMfBEm4Afk4fVTTkLMg= Extension name: 247d247l76 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0C0C8131993EA795

http://decryptor.cc/0C0C8131993EA795

Targets

    • Target

      629f8b33cc1059573525a2502660f13a529b82a8a315d938d100ed9ba798c7c1

    • Size

      117KB

    • MD5

      88f4e14594089b7c2cbaae357a2e29e2

    • SHA1

      71a1ad7213291a5a7e5e45fc65000f03f3864f60

    • SHA256

      629f8b33cc1059573525a2502660f13a529b82a8a315d938d100ed9ba798c7c1

    • SHA512

      a31bb82b86eb3076450bbc655fb102dc46f9e11090b834b45b38b570c49dd80592b3bff0c24a46005ae963c7efdc4b79a252454a1d8668c58c86f562100db3c8

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks