General

  • Target

    3f62801a5d4efd7d14d2358665f3999d23acd4298849a80b9831c61e99008c6d

  • Size

    164KB

  • Sample

    220124-cns1naabhn

  • MD5

    0c31b58d5af03e17c87cc0a74ad69c1e

  • SHA1

    8d5da365d44a34108eba309b7ae86e665b9ec647

  • SHA256

    3f62801a5d4efd7d14d2358665f3999d23acd4298849a80b9831c61e99008c6d

  • SHA512

    398b914e3bba76e81c3c33440917edaec4ec4a5c34d3f97835fc9af68220d70ce5a3137190e1fa4d3699170cdddf34fd2625d99450d51e7fde8a01552449aed4

Malware Config

Extracted

Family

sodinokibi

Botnet

43

Campaign

1738

C2

pxsrl.it

jimprattmediations.com

suitesartemis.gr

werkzeugtrolley.net

catering.com

hensleymarketing.com

smartspeak.com

customroasts.com

rename.kz

deziplan.ru

raeoflightmusic.com

skooppi.fi

singletonfinancial.com

b3b.ch

aoyama.ac

cc-experts.de

kombi-dress.com

collegetennis.info

mariajosediazdemera.com

tellthebell.website

Attributes
  • net

    true

  • pid

    43

  • ransom_oneliner

    ---=== Sodinokibi Ransomware ===--- All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1738

  • svc

    sql

    backup

    sophos

    mepocs

    vss

    svc$

    veeam

    memtas

Extracted

Path

C:\q5o4srd8s-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension q5o4srd8s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CEC714A652AF73C9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/CEC714A652AF73C9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: CcoqbmCP1KQP9KGVJYH1a3QaON8Bak2AbQB2cEO0bxIBkQgxsdN5nLJPMsVov8iE c9Y8nPXd5gu8h3vOe1EV35fIG/zOsWH64dnwCLhuyve28JCFc1bhXoOH1K5S0uBR J4Fu6O/2BChZSRqZqyuORaFs1dw7BPeNEMnEJUE3ZEf4V/grgzvZT2REB1mhb9UW /oPlbf7EbBuUiWYMl/GkazUMhBfpnezSP71fwhYmIQR81U+JQFPPmOfIIQ0CEcjK dkaLfdgm2o7pOmFKCL4omOb4HryrgKI+m4fw73TWgAHdDregCcemGpU+H0518NYR FfmLTJKIlWnqJEDfvk1pwFBzZvdvsuWUnOkocFNC4GrSpDeyxeWbsVL9nELgy8PE pKUtGIZi7sf3eOelx84E+Yra8grdxRjxXl8EoAeuYf2dwlaB0Hgp5aK+YnoMS1I9 Cgq25U2qeTcr4cxalEWNRO7fuLxaOxkoutwreg+9n4dWTtYVEqgqkkf8vEFBROB6 nIpJddWflrvdSn08nFkYpmJdfXqPwU/P0b5dxuqfC3tiSd+okaC65uBhnmAEgg3f zNvvX2eugWYofQx6d7EMola3Uq1XFtsoupQQWY34B7ItvbgiF2T9DFpMx0E7Mxqr WFsFaOJHZIxynSWZ/aflI5d80kRQ9VjK/2aGoHTbEkvq1+X6PJZGeBZ5e2K2Mdux 3TulN68GjZQKpFGWEJPrKnmfGGBNYa4ZbVbhMAgWhWZO45IdLrr1z1DAipQSWoXB TPxi4ZaP6vpnkr4DE9+b99QV1Hqb+0X9jxekUegeO9TYGvIUi/SXTkocrz+cPdWE 2VubGaDKLN2gwhaO1OEpA83Q0h2JFNcy1dfD+7KCIBVPGS+q3y5PEzpWlcP6FjY+ clGnxwUd3FboJXfOQHJeBwu/wG/8jmgnIf1ko4eiQYZrKLNV2uF2Eeyb/RM1pbE5 ES/QfkyXNuIXQf2qT6bGgtlHFFZDqBx3HzOMiLvk3M+SqSj3BVWpjDop2ObAhqYE sxi1fQdgHZb3qimcZmeKA7eSKCbf3DXmrP5B+fWSYJtt//5gxJ71cP4jrCgbVD7R 0XkcKERdAOpQaUk5sMsxzUBxts3rA1X9MLvzBVcmgy/314+/dmrDN4GjgRC/uuj9 0woeh3BJSkx9sQ== Extension name: q5o4srd8s ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CEC714A652AF73C9

http://decryptor.top/CEC714A652AF73C9

Extracted

Path

C:\d47b09h-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension d47b09h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/65B8CFFA2D1E3F21 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/65B8CFFA2D1E3F21 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wa0TOXson833ck2YeP12D80fZi71BkJbHvpPlz0QS90tb3psywnqf+MKPd9ksSF6 C1BunfZ0xbWPqj3FSu9/peFKgoHrWIacZ0AZ+l9nzJMjh5tYmMZ/zlzHuZOflwKW GwP4imzOGxViLgtjtSulEBE2ZOmcQFupKaohmzsyHgLBoPUJk7raNoRpPgwDnPGh 3X40XXfwF7C0cLehNDfK0299Wb9CqlgVSfdndHHAmg/dQ2nDJPsaDiVeZrzhWEXJ Ak4n20ktlPqOlp/9DQCL3p2tvnEsWfaxOmfDzoT0x83KIZ5bVevHjrKvRFA1XlDz 5KwSycydLiTxJOty7g5OT5rGNC1rLiTujcfylgxCXt9Q4GNnn9XB+VeRgx/i9VJw r/vt0hBuxLpyzesiS7hRIYux3uPmenuo6R6q5fvFcM1mQk19anIiNiF2yninddJm 94eIa+Jg/u2cm61225/lqVP/OkrJ4HYqtbOZVuRD3UkvddIR8nGmkQRvbrmyzPAj i4lLgDA492lEg/TmFiZtTJfDbpj4X9znM5P36YasmYBEkuMDLjZV2ykTljxt5Rk8 PWQqS/RizSyJ0jt3EwvjfD9EY2+enUY56jqSGXsjIJzXpW0rTCHAqQrCq6FN8Vii DpExhUUCLhPpoqcE6hkg8m7IXs7kyGo+S/BkDXaNIhzc1y2AUC3hQbu+300MRAo8 weS6srgPNidEYCULGasiHJBSZDV+/eGft2D5g666MnSZttuWU/POoPjL2Kiu/0ke vVUSnxCIaUwU1JVQaYzBH963qhlySlK1Lh53CQ5BLZnK5H7YSvpkhZTiXSBPL9Mf zm9xNAwAmEteVPDzDO5Dxtbi7bXIvS8+HN/ICdVQLHq5TDeoynU7gUYyqYld1CTr LTv1CtZsjxClUqjwKaJyMyQMa7uCg3K440tQ1MMZ7/CurQHOhtFxhzZYFXO3uqmB 2KKrnl5rGed2zP1lOsaEwg5bPVpCc6oLIHUOOvKVOLW+b0/+7SgOuuQKKozFSHUn Z9lT5B/sBGLazPoZrQ6JlOecpqNhYUyRxEzV79sBimgshw/Lz2i4bBsWnZOoe754 QAKTUK/zq20oJ+3anYhm+HRUhLpAJ+bW/htUPvJmQsU2hFpFs6qAEK05vnOdUA== Extension name: d47b09h ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/65B8CFFA2D1E3F21

http://decryptor.top/65B8CFFA2D1E3F21

Targets

    • Target

      3f62801a5d4efd7d14d2358665f3999d23acd4298849a80b9831c61e99008c6d

    • Size

      164KB

    • MD5

      0c31b58d5af03e17c87cc0a74ad69c1e

    • SHA1

      8d5da365d44a34108eba309b7ae86e665b9ec647

    • SHA256

      3f62801a5d4efd7d14d2358665f3999d23acd4298849a80b9831c61e99008c6d

    • SHA512

      398b914e3bba76e81c3c33440917edaec4ec4a5c34d3f97835fc9af68220d70ce5a3137190e1fa4d3699170cdddf34fd2625d99450d51e7fde8a01552449aed4

    Score
    10/10
    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks