General

  • Target

    4808d86fd26fa9e62a959f6cb31ca2334cba8b834b6287fd72bd512eee6e1880

  • Size

    164KB

  • Sample

    220124-clnm6aabc4

  • MD5

    f0284d4e56bde839b8b440a949928c90

  • SHA1

    588210f0932ba9edb88f2f0fdd6163f6c671bf35

  • SHA256

    4808d86fd26fa9e62a959f6cb31ca2334cba8b834b6287fd72bd512eee6e1880

  • SHA512

    0ce3d5c8e2ea534630ed3fb4b05dddc1710c44abc7b522f19ddd418e2c66c78f463429d13fddc6fdd5c050dc315395985a90d79530c008ac5b6207db0cabec2b

Malware Config

Extracted

Family

sodinokibi

Botnet

28

Campaign

1513

C2

mazzaropi.com.br

imaginekithomes.co.nz

business-basic.de

jalkapuu.net

egpu.fr

indiebizadvocates.org

onesynergyinternational.com

thenalpa.com

daveystownhouse.com

brunoimmobilier.com

askstaffing.com

paradigmlandscape.com

k-zubki.ru

satoblog.org

encounter-p.net

lagschools.ng

masecologicos.com

letsstopsmoking.co.uk

mangimirossana.it

hekecrm.com

Attributes
  • net

    true

  • pid

    28

  • prc

    ocautoupds

    winword

    synctime

    excel

    steam

    thunderbird

    firefox

    tbirdconfig

    outlook

    wordpa

    visio

    encsvc

    ocssd

    mydesktopqos

    mspub

    mydesktopservice

    thebat

    msaccess

    infopath

    xfssvccon

    agntsvc

    isqlplussvc

    dbsnmp

    powerpnt

    dbeng50

    ocomm

    oracle

    onenote

    sqbcoreservice

    sql

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}_Wannadie.txt and follow instructions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1513

  • svc

    veeam

    backup

    memtas

    mepocs

    sophos

    vss

    sql

    svc$

Extracted

Path

C:\i4837_Wannadie.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension i4837. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D42FDF09FDCBD268 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/D42FDF09FDCBD268 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 4RtF2blVYMGL1sIkWUiZWLCgZIvWpUjNiwQuMKbK8LmErkW7ig8fnEbrt615oxWn CyqYuwfy5jxPJXz9KuiFiwzPp5+4tHgJl+J4kQDZCX69R+IP9AYS2lSE7D7gD6j2 TmiySe4Knnm7qkxiw5cuecq1zOiIonCi87ET3G7ennHU6ILP+bDE5gcezKZ1BgiF Isy1JMPLcRGNoyy32aEbUszgL0DjH6CFC2BKFdal5u/70eiFPA0Em/3dbbm/JrVY hSEUycW99VA4NW3NkufJAOxz534vBoQUOWXKOVBjSIITnVh8PJf6JTfVRS2oL0tb cvEV4Mpmb8arVZ48tmwNcvxq0f3yttF0bF3aeDcOnS6p4m+re8La0KRrxF1QgOoU VbykCfz8cLGurp29hwUE7TrIGhv+JXAzJALXFZwBiqpVCKx62a/EGGhm4xiMgQfb 2RVAHLkacW4tuQI06GIgvXvCn+mP96Na1BHAlYBumC3IPGggULI+JwUpuKsAlmfQ awUVzPRtiAHYfllcHYlUmCnlM2Ky5fY4xfBtCz1B7YyWiFjGZ8zEQtFwlBQDM2C1 +61w/NhuzOY6Y5T7fKTMywdv6Moqh6+oJEJsXHSYEueYFUwFCyIDeTIozE4a3cYL wfBeeGuV+Rcg/QySCzMedjS1vhobzsXBcJ3575u/sQuSyn4CaXMNf4HFU+Q43Mm1 Dg9rKT5+sb8Bn+TbzLBUP1QUIUOi23W6g5Pmri1tPsUCTYMqAb8/ZV+PGCyhExWR Ys0dtyUr4L5lgOxyWNbPdmjB48xCmixeI3JlGaRKBETakCnRfBZstQ7VPQ6ISh1t FFQVaw3U5ow4efAP6xESuQ5YdMDPFkj4NN/O4zfDz66n+qjdbEaM+gXu3ODMp0QD zcHbxPBf419e0uLSgn6q+35WN2V/G4vL/aJkVMMEEdHuAlU/GLQ0Xr8wvtY76KvH gom4JqSBw4GofddgZwbqUFlr28sqw+d1n7d5n0haMa2m6sZBw7garVBMXqN2eI1g ltoZCWLKML85DfZORzVo+ogsPYtWIeFRgf+HlgqMjaQo5qhZViijGPnoMO2ZaOIK +uuzuyqqXkaKpSTJit0guNVpTJaZWii7OMBZLxxmYTgnR5PFhc4XXbgWoP75ALtk xqA= Extension name: i4837 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D42FDF09FDCBD268

http://decryptor.top/D42FDF09FDCBD268

Extracted

Path

C:\a58q50o_Wannadie.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension a58q50o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CAE6068BD15003F0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/CAE6068BD15003F0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: P2m+G2Aw8NV/EIMxuTNglkr2saVKQarSdSkEBAZDGWKVPo2u2ELkjV0Ww6IbBZpd tUXnsT2eh61HTVy/gUDhk7djKSPTqp9Pb5/tDGdq5ZAxFe2khgm2BV1xbwdR7GN+ qPykcxVj1mguoqd9k4G70qMaLFIwxxeJmhjZM5Wne0AiWeOJWNeKCWodL51JF22V YJC+NuF535Fua8hJVrJWzgY5mChjXt1XhI6vmq0ilz2bD1wLhbwS4JEHez2Td/i1 zArudhR/D7mJf121bWZCks7/ZAftF4nKP1r+X4WEWXoFhqq4IZBF4qJNpln/o63V 5pUiPagnDsXdr4iwTKQ4YYt6Tg6/9EsdaJ3epBfvGDAfHRYMDNjS7jQGLZSgKoKf DY5mzImC9WU+8yS/GhBn7QfEdKoYWuG/4UqHHqw+ABA0d/lAUX1kEmYcKnxZy5rE ItPogDCAx097CV7fSWz2r8Uq2mHcNuvcGRywiLe38ogbkY8tzZ1FEAQBJuUPmdXV cwxIuBCXCmsLWChQk2dO7s4RIA2FDZuOMccKiJw9fHmxL3frOoY1/qkF87cF3XXa x9/uyo9O0i4pxg4lu/8Pik2srWad82ICebPGvlsQj03S+i3J3sgtgkdLqD9HFsae a31pdpJ0G9mwMXqssnUpQWSL8X0x+xcZ/NsTmD/S5hV0zqAYFy9IFjpwJZkcMtDF xjiobqGgbY7rUFDjBmBfIWFLzrvboU1Tvfr9haYU1HV6LwvlJ8jtLZNYlNf+KcqY Ila5deFDl4QwRl4iNdeAJE3ME8VT2iwcYj11l/4W8a2+g/Jzw1WWrhtooLIfIGF8 Js8n4i/Vde+CgAxsLqlAkZMB9SKvzqdg+vTCy7Lx9y7eBH558tKyP5EdeGjrEtPI xPzsPIb888pC4tuYLhCGYeZTt+pC+aNoUh+ZjNw//qERuyTqJxZFE9gxNIh1wd7l 2U+nJUmWH3d4l5SPU/6Y3Mit21HR1drJENxf21PbBZWw0qAgVHsUI7Xj91M4S6+V TS64ZkiVKzTItyexyHdrSRSeQQK4UkoXqK3zRXMseUKUgutzdPlyqwUjwEMx1oGe TJcayNEJ9PiLoadpOCwtEmB5oj80YMpOY0WPPResfmQxeVSCDJkHtXt+BMHAzQ== Extension name: a58q50o ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CAE6068BD15003F0

http://decryptor.top/CAE6068BD15003F0

Targets

    • Target

      4808d86fd26fa9e62a959f6cb31ca2334cba8b834b6287fd72bd512eee6e1880

    • Size

      164KB

    • MD5

      f0284d4e56bde839b8b440a949928c90

    • SHA1

      588210f0932ba9edb88f2f0fdd6163f6c671bf35

    • SHA256

      4808d86fd26fa9e62a959f6cb31ca2334cba8b834b6287fd72bd512eee6e1880

    • SHA512

      0ce3d5c8e2ea534630ed3fb4b05dddc1710c44abc7b522f19ddd418e2c66c78f463429d13fddc6fdd5c050dc315395985a90d79530c008ac5b6207db0cabec2b

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks