General

  • Target

    5c12fc6b90a463a1cf68bc038627751942d1295d76e9c2b58e459b30aa62705c

  • Size

    157KB

  • Sample

    220124-ce7sfsaad2

  • MD5

    73b86d7e979be3808162a2b7ea02d418

  • SHA1

    cf6ed049f1675d93e68a0bedaf36c6095a17831b

  • SHA256

    5c12fc6b90a463a1cf68bc038627751942d1295d76e9c2b58e459b30aa62705c

  • SHA512

    42b4363b816b64efcbe86dfbfb1b5036554e7b01abaa11e17eba6f466f1e4b5f9eef988c27395d9bfe94ac815b6e061636fe7f1c72eede234e4c6376eb7a0b8a

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

Campaign

1428

C2

ecpmedia.vn

triactis.com

promalaga.es

siliconbeach-realestate.com

bigbaguettes.eu

web.ion.ag

spacecitysisters.org

abogadosaccidentetraficosevilla.es

blacksirius.de

sipstroysochi.ru

foryourhealth.live

schraven.de

mardenherefordshire-pc.gov.uk

pubweb.carnet.hr

joyeriaorindia.com

makeflowers.ru

seevilla-dr-sturm.at

podsosnami.ru

stupbratt.no

jsfg.com

Attributes
  • net

    true

  • pid

    $2a$10$i4Qf7geFCZ7lWOdqqwWhheHJ42u0kNQeWmIjHYGkdN1NhIwuCa2va

  • prc

    sqlservr

    excel

    sqbcoreservice

    powerpnt

    mydesktopservice

    dbsnmp

    msftesql

    steam

    sqlbrowser

    ocautoupds

    visio

    sqlagent

    thebat64

    outlook

    dbeng50

    mydesktopqos

    onenote

    sqlwriter

    tbirdconfig

    agntsvc

    infopath

    encsvc

    oracle

    synctime

    mysqld_nt

    thebat

    xfssvccon

    isqlplussvc

    wordpad

    mspub

    ocomm

    firefoxconfig

    msaccess

    winword

    mysqld

    mysqld_opt

    ocssd

    thunderbird

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    memtas

    veeam

    sophos

    vss

    svc$

    sql

    mepocs

    backup

Extracted

Path

C:\z6z1m0dx-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion z6z1m0dx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1BE205D0E3216AE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A1BE205D0E3216AE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TciHbGgpRE1lkmFdIkDLjyHLWAda+a/NDx/TMUHDnv9OrZk+tUNnlAEQ91YaodL1 IH1k2w2vAmavvvVvHRRN4US6vEB0QiXmM/a6vc0/8OxIlG6aueOY7nU0n6QAGRkN tlCfSAugtUM44iFst8JR68pYw7GIZhU8kxXVKbeAz5RbH+lBjlETIITJkuQP+YMe 1tmKb+tJsDpUvoNmG9cq60v4pffoZ0BT1ekneT1E1OJXIJgtHBmQCcAZ3Sp5rpG5 PcNr7d1k3XXR7l6iJ4ELyO+zt9KL8VuumO8wU8CXCRjeJaDbnS/SVzIr6eHIqWT1 qmTra6odDDroEFHfQdKkKbXY+bhngiLmNzQ+sp7ICKU5jrb5xKwO9DauOsWsrhNw A5rofChBUpfOh1EVJZOcZyNIVS7yvzjmS1prYniLa8syDDjgldXO49BpiRGcVEGU kzOUdP5dcH7BoMqKnFgrq4F6dlTADYKl0DX4W1AbxONuim4gRCYUHSpHuicEx6tI PkfQQQ+hVDjb0ZKljWPMnRWcwUAxo+qGD+NcJUNwoKEv6DCR3keU/pkPEKGbylw7 GQ1vL7Ajmi7jSLrdwqNCIglu4CXmY98rvuuClPrBuwT3SbITKYxLfbeYq/gYaAXR tfib6/j/DilmZRUcLtZBTtv5tGgzdKmBTpzNdMlkFcnroO/4jlrM244lXSMGZRd0 fwmVznRbTP346Iwztrg+ns1Bm10LQ1/T0tFHVifhIi5244pnvrmnACwUFAsyBP2V fW8S14bNpwZm6QGnkVDM0FrUmeqm2AjiGgpKIMstjYbXaocDLTYTmvE2YXRSPEWs QD1hbmgxb8Ra6sKFovmrF4UdfEr/mXc9qFKAtiH2KFlFtkNFpqOFWmGHoTTsnx9a jNTBPt6hjowac/ZdEGXadY2aX9H4GueA8ELbCWSVJO7VUij12fZReEsQmQUKWVbK OWXHPK7dw3VPrh5okEMeadXJdMkvj4apTdiIKsBt64k1tsLpTrhb0mhPQ1nfsppg G7uestuZP9ULrrEl2jgD+M4DAlLD+8lIktcwwKr5Nw6S8DRwOAGdd7lEv+EMNWRL OGN1zzB3FOlp2YlhbQxtCb57iNdatVTSEZmd/3LQ6TICTymzH+gnSLfdsR8SoYKt ubGNUsroUpN4LD8oabf52jL1zCni3BRGYT59dUg3FhltfPql6Ll1QUYFgowHf0Db Jr3aaFe6uxyqaJju7OH/zaYtas33yyYhDZVGGuy/DiyHjDXB7gkMvqYmA//+w4Wu fdoIG5v3WEAHbCcosUXWMzelK6srW18Nc77IYA== Extension name: z6z1m0dx ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1BE205D0E3216AE

http://decryptor.cc/A1BE205D0E3216AE

Extracted

Path

C:\495e2zd-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 495e2zd. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4A54B2811A9C00DA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/4A54B2811A9C00DA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: yRU3v742Y3bmkhrM0z0AgcQ+1frYoRRNFC4YwqdYY632T8zj5Ibh2Ktglohqg7L2 UUklv4No5nIGYS/9IzxLeMH95bbZP94X1PjlXzy/4MS1HJtLCNlqROdsxFykqamM fmBssAeStVrnkztOD9IWFN/X6n5UUoEDGCzMt39oCKRV6EGAEycr+Vjb7kLLOq1D Jt2HpwSaUNdsSKlcLRUhbA65LNSS55xNDVkU7lsA58GJKYSnyR0QSeHnkOH8rCzd 0ueQQ7UegD3xD2KzHlHxxJAYjoGgoqrPJnkkMzknsghaFl8uNFkymKLzvb+96ZiJ jf8tbUEGGIrW0RVlYtHCkt0eFY+MPGzw5IBEp6+11ompW17GLTQlD8dtP3SYIy1I Q8ehCVndDX3kap+yBvTpGHzhlH+dRpRQ3ys9PUfNl9VsLSVLD74q2V8dRvFGoQAw 4wf+B39Yq7k3ioYNfNr55vr+CXbpe3HsXraTKfvxuW6HWX6iU/5O1OVn08oazItC YIuuiXtjVGnO55FW4kRC/zuzPVjgcaxlwVE45mOVIybEDGHKtOG5wpnOW8JJXEnX 6OA9j+7EqXHkQWXCdmnGE/dO5G32sWF8MyGomLNba5KMK/YvDtXTHE8RQi68GFPV qa+FUplnq2deGiBbrQi3pCEcXP7wNz2HQm1jac0nn4yWRHjqCYXxLroJwI9GosBo C21zIQNv+DdwF6uEbCLRUeh319PFSydjNHNwY+Rc8Cs4oaf1DDf0wm7RSK4UP9up YFWnAMXUhMmEtxnsq6Nolkv54UOeIIWDSYyJTrGbfF1GL+e9ApSSTDB/a3Ywutey 9AJQjuIxy2JZ4pnyq7x2VuqAVW+T6WjeJyOU78eZOU9XuQ+bYlIRt5eCg0cYiLn/ t1mJ+gswS6lx6pky7F7ODJMLCR5kWhWAuXJhatVZ5kTVoG788m/qXu2QIHzzvunc k7THQOkItoJQNCI94jGMi/5S8eKh13yQ2UgXOiNzXuI2EqACvHPBrjiWfWwoxH64 xtK85nS0exREHI8cBMaGt039fjmN3Y4sQ8qgueQxlJUnrEcN/O56ncK6dVAWrzJb tq39qv4s3MnWC+glODy6Izyzm4Z9R/4sbRq77Rah1aud8QrCZ0RN8bO6s0b8aoIK 7LGDRTEVTL8uHJykM8gWK5SqzVNw/UWaZVY6tsmufPWXzhRpNKeJjlxAqTCDwUWW 9dRM7Ob9KZ364EmyreYiFXRx1zIaG265w9Y1YXAWxccK+594DMJzL3GsiRJ4ZoWj kqhBzpoXqncwU9uvFzOc/oQc Extension name: 495e2zd ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4A54B2811A9C00DA

http://decryptor.cc/4A54B2811A9C00DA

Targets

    • Target

      5c12fc6b90a463a1cf68bc038627751942d1295d76e9c2b58e459b30aa62705c

    • Size

      157KB

    • MD5

      73b86d7e979be3808162a2b7ea02d418

    • SHA1

      cf6ed049f1675d93e68a0bedaf36c6095a17831b

    • SHA256

      5c12fc6b90a463a1cf68bc038627751942d1295d76e9c2b58e459b30aa62705c

    • SHA512

      42b4363b816b64efcbe86dfbfb1b5036554e7b01abaa11e17eba6f466f1e4b5f9eef988c27395d9bfe94ac815b6e061636fe7f1c72eede234e4c6376eb7a0b8a

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks