General

  • Target

    5eb43204b611cace05c47e2b6df1c37343f7c585cad9992dd39051c5d2c1e73b

  • Size

    166KB

  • Sample

    220124-cd8ncshhhn

  • MD5

    ef2352669d8aa88f9fdedefead182acd

  • SHA1

    48b4f8b70a8f937af7f8888223209652f6a5d229

  • SHA256

    5eb43204b611cace05c47e2b6df1c37343f7c585cad9992dd39051c5d2c1e73b

  • SHA512

    5cba9efbcf919196e0e142e8c9a87acee65baf8af3ea6a14dc8f4e39eef94c2d9a1e86e57fdecb2d643b2cdbee5640d3b5db96e63a608920a6d66e0ea639c962

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$Tphwr9LlSOB8K3/pTVWV7eKmKHrXDvdOolDJayLa5.SJ.jyMLYUL2

Campaign

3144

C2

trystana.com

jameskibbie.com

nandistribution.nl

blood-sports.net

personalenhancementcenter.com

ralister.co.uk

live-con-arte.de

rhinosfootballacademy.com

devok.info

maxadams.london

web.ion.ag

pierrehale.com

ihr-news.jp

xltyu.com

phantastyk.com

desert-trails.com

ncs-graphic-studio.com

ahouseforlease.com

pay4essays.net

sevenadvertising.com

Attributes
  • net

    false

  • pid

    $2a$10$Tphwr9LlSOB8K3/pTVWV7eKmKHrXDvdOolDJayLa5.SJ.jyMLYUL2

  • prc

    steam

    sqbcoreservice

    ocssd

    tbirdconfig

    thebat

    ocomm

    excel

    ocautoupds

    wordpad

    firefox

    powerpnt

    mydesktopservice

    msaccess

    dbeng50

    agntsvc

    dbsnmp

    outlook

    oracle

    synctime

    winword

    encsvc

    onenote

    infopath

    mydesktopqos

    xfssvccon

    isqlplussvc

    sql

    thunderbird

    visio

    mspub

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3144

  • svc

    mepocs

    veeam

    memtas

    backup

    vss

    sql

    sophos

    svc$

Extracted

Path

C:\m4jvb8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension m4jvb8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A97CE07AAB242A7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5A97CE07AAB242A7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: jJNuDLJ82v7mcwETfEmrv4tHjX4lJhD2NjTcMexGVCel6DcwzzNu0LtByGhY0T/N 0hB3wBMMkBSKSpqa2uCi9Vd+CgHEUE3Xh7pQsML3CNGR7gLzdcFmM+SiQSQr/D2p VDpQIMS4Ey7Utpz1nqwD1VKPXAXanJ4sAfxVTfiTXSGSTQ9sX4CxDfpQbO5aJ4C1 hxEs/Va/T0e/0e/pWwNJ5fLElXtqP2Pq3rVXHAjUsQwbHGRBqLFRYt5lqOiIsP8Y 5E5efbhTXNj4wKVxcTSk6nAQljRaWGmL2aG7ixHJNAlW2lS9Lj5XosOjM8KivVQu AqRkZq0rF75zt6XhWz7h63omTShc2lzc44XcyXrmxk9Mz5eShk0SJTsEixu9LhFT to6FW206UCqowOkc4KR/3AR+psMJcrJAtlsG9mONpbXTpLw2E2283jWHN2SLPr/f XGzjjDocIs19QGKZxF9iZSW5l1oeyEJrsq5zyuKLX2L0AP3hWK5/jzYCQlMAp+2C SNphP7GftPs0mNedggrPZCUQ5y2xfTbFwhYkDhYZf7vw/os+lb+IjcpSS+ZvhGty lDa3CG/tRg7JYlGrblWKoRWwHT6D2rOOTUvJgXXfT99pmC/oWQQJh6NTGOSuiu21 6dIm5MmbEKfdMNSwWj4nzLUuF7fpJr7LxiDrb9J7P4kT8CISvtYDFH2EdzOPyy1f nxkZeQ7UTQbakn1jgHfETKbP8t7gIn+3YZ47pv1KfaBpohql8ykqK4iuykdf3r4a HqGkWlm6TSZrSVj6Prr/t+LjdH8g2DGCYgiqgVWV20lsesxXugiFdkUhUx4Jp5ye Wh+nt36QIqxKLfXQ/LGOEYTkj4SAROYRfdv0AKEV3O6bIiWVlP8oZoYZnIfuVQZ3 3DHoiNj5RQ7ADiT7qUpHCDw+2oozpovSs2o68QLiSoML4yCsoclMGMAoCtG1W39i ly7VA7iDyPvHlz1wP64l2YCgEn1fCnZ9jf+jTLIFJouzIJykWpad6TBmpe9nHGol +9XiwJTDTFnyKTm+5AyV8Ii+Hf/kX6Wqh4B8KCBp1JK+3neTfUGxmxq9mvRfLkPF cISlzvuzEc3bGz1eYs9CozxQSxBs2n7i5VPy5ZH47D1xEx5aB9mBqDc2bQ0gQITo 5816tQxjCMl9lZSFOuwX4o8TUxArjCZ9NJm9vfZs8puYV+JkZRQ+B7sWpMr5Mdtb Q+U5Nv990daTNBET001p+1TgmxBs/txLFnzZhAyUdFPmNVljhvSQQea0eHVWuYMK OTRlXGkdnXzX6M6YCpwnD9zKTdMsg9Qd ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5A97CE07AAB242A7

http://decryptor.cc/5A97CE07AAB242A7

Extracted

Path

C:\z513v6e6hw-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension z513v6e6hw. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/24175D0469D1241C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/24175D0469D1241C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: t1S7+2oXGUbPY93k1xAZK+czgEeS1rYNoO2yzNl8U6wOziQDyRF6xoEHvrun0Tdr AzxSXzC7xiXd/QQFQETYVmzu9n88yOV4lNgq3v++gqjU716YK699G8MRjrxiAJ70 jXk8uI33hg+pjNPK/S99u3bWyCerDmCXQCB2Ymemc3aBV8vzcM2Cb4HShwcCAlg7 O+KIrfNKgw5thVB9gb9J5LA3R8zfyl3Pvwnk2wE4dd03pS9cqdfRs2p1nK6KcXp5 jLWH0ftfp3D1kH6rqpAhJu21OMFoYatOl1jXuEMY5D1Kx/t1fKHzYpfB+71xbkHF Kc3cVKM/jG02zdcpSUttVGozecyNs32DmpEMYuHEnRrvM0EHxtI6+VMwnNE7d5W6 l9x1Fyd+40FCA+OrpZ+hTMUrvBBdBBXxx991viGUwnbkdMqVRMoyreBcbPu7Xuzg tV1JEhk9b072oD5sC2Hn8uZd2qdm9TCG16V+jLhCpjhQW8DQGhF7G3JJHxTokRmK 7P9uq94s9R1paGmpF+fMjpWV7FNfIV4ok0GfQofXeo1uEzwh5UbeamsX49cKyJff Z4aYRREV+WFTeaNnzpf6TWe8M8P6xzbPXqxZpL+6hkjol0GlkEvNZwIRREEc5Az4 KeZI/wjZBf6raJUMKsGUbjRHsO/QKYaa6p2lNcnhoj2xaL7JORwKzH/Kh2gKjmH+ iCJiJ3alrQhyNLA5fqm2YTAVeTmh6SXQRlzx2YRW+0i85iQpdtMK/t0tG/eC6GPc Axnq52KhO0ItDaS7gRwiivHZq4/yu+O463F7ut0LBIRk+6oyZba4eReyKxS+Qtgl VVN7zL0kYS5bKQ60OahRYYYOdP5zGG7qaEWD+dlVN/RLihj0xT1EPdjdgVBAcNdc gujgWy7V3lBro6bjFe5tJ8yn0Zd4AhEqCfzC4Ac+BLKjf2VHQnsFrO8urSk4QaxH oSR5wkOlq24/IulQ3rvg+m044Z3GlOKem+KrBhJ3nhWAdPbAcD1fq1u7pXEyU1cv tVUvmLE6yVXDVq+XvG0KcQMPPKaExWmkiaIfo27p9z1cCiPJnHG5eN/N8USBI0lk 4w1KokJLGCV8OhQmaowyChHAZPhJ5SVOMPWHgFnuIvCed8rt0jsjHKgpimGyB7Aw xRlTve/tUA9zm2rQrv6qTmQ5XwCcmAOgPkRbNJacWsyQ/1CM//xF91GAjQI1255b CbuxHJ7BoZXeb7xhGqNYyGxOna7WGWcNqOzuNA0si5vmv0YtWfg//zXtgAwbDJF4 qNQ/af0Kqw16fWGfT3YkyebQiOLB6xwR ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/24175D0469D1241C

http://decryptor.cc/24175D0469D1241C

Targets

    • Target

      5eb43204b611cace05c47e2b6df1c37343f7c585cad9992dd39051c5d2c1e73b

    • Size

      166KB

    • MD5

      ef2352669d8aa88f9fdedefead182acd

    • SHA1

      48b4f8b70a8f937af7f8888223209652f6a5d229

    • SHA256

      5eb43204b611cace05c47e2b6df1c37343f7c585cad9992dd39051c5d2c1e73b

    • SHA512

      5cba9efbcf919196e0e142e8c9a87acee65baf8af3ea6a14dc8f4e39eef94c2d9a1e86e57fdecb2d643b2cdbee5640d3b5db96e63a608920a6d66e0ea639c962

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks