General

  • Target

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

  • Size

    166KB

  • Sample

    220124-cpejnaabg2

  • MD5

    340b6f816bfdcfcb466cfc126c976844

  • SHA1

    e2e3adfcf621166a9f5bb7ee9795b7914cda2095

  • SHA256

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

  • SHA512

    3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$maSqYzCs2s.gezYwrFOoJuI4SIRqDq0fr0z6iKBeb4EdgQpwYnYjq

Campaign

3385

C2

balticdermatology.lt

liveottelut.com

michaelsmeriglioracing.com

spsshomeworkhelp.com

campus2day.de

madinblack.com

tanciu.com

agence-referencement-naturel-geneve.net

jakekozmor.com

tinkoff-mobayl.ru

myhealth.net.au

maasreusel.nl

pmc-services.de

evergreen-fishing.com

noskierrenteria.com

galleryartfair.com

importardechina.info

trapiantofue.it

tux-espacios.com

ecoledansemulhouse.fr

Attributes
  • net

    true

  • pid

    $2a$10$maSqYzCs2s.gezYwrFOoJuI4SIRqDq0fr0z6iKBeb4EdgQpwYnYjq

  • prc

    thunderbird

    thebat

    msaccess

    mydesktopqos

    ocomm

    ocautoupds

    outlook

    xfssvccon

    wordpad

    encsvc

    excel

    agntsvc

    sql

    winword

    isqlplussvc

    powerpnt

    ocssd

    dbeng50

    synctime

    visio

    sqbcoreservice

    mspub

    tbirdconfig

    steam

    dbsnmp

    onenote

    oracle

    firefox

    infopath

    mydesktopservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3385

  • svc

    veeam

    backup

    vss

    sql

    memtas

    svc$

    mepocs

    sophos

Extracted

Path

C:\e929r67-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension e929r67. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/64C6200E6A613BF0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/64C6200E6A613BF0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 3LcbdRmDts0PWdZ7axA7tueg5LCMCkeJ8bXjpEs8fwn4zOm4deZikXuoXyUH63Yb 0UmMQxZjE0drZ4ZLtR94CTL+oCkflo+ib6aZAw5dF5xOdCIFPCh6c+V8E7nu/UeK ol5zyetXWHEOLiT7YdM2H1NxFn32QZq3sdi4kOvIALu3MsjSQv8j38XcG4GLDykE +/pRtqPjm5O+OO+lTPXBT7VCoUSkqKy3dDYs5SXIKnN9NceMoTWixnuZKCKm5b3+ 01CaSlAyJc3SFp1LRqTULxzFHWpyV1MQNt5zY0c1ZwtU6wY28JJmVHUw2X9wtyqB O2fd3kD1PwfPoVI94rBSfbwcqukTc0l6TnKbY47wA/oG6Bhs89zwYolmqUcnLwIy fz6zLLZeVLbzJK/8vtIbMd9z8VIzbepTTuzjS78qloDVOvXqkbTJsfOsXFkt2cEC L+5b6tSczhmxSWmfbMt4EFBtpWxRBXoRMFEllaaVqlZzsejNAI0MqCrXdT9EQpI+ 8HIAMEzZb2UheRPx1GHWk7swNATOBd5+AL8F5clUGhYXrJ55CAyJcsEP04tyIAxg VKmaVUmuhplZe5UMqwNTfaPpSbCqHgkn28LveO7nDHRntuWNCsVIQ4EgmTrkc/FS 1Wtdk2KExZFl7Efn1ImHtRAG2VxGG3478KnWxJAZjOoiRsL8W0tXfV/25si0LwKj Do/FFhbU3KkRNLniolv40GMVPCLNHZnVtgU9mzny4Yk+LsOsHOUa2QxiVjLJ8uGN HtuLADgUGgNT37+mwmNRSUu4nhOuhD2UDJOx6HFwbkspHWJ+Ihxpq+rry8EBVADB crmQcSrMXRFrMoEMu03nAoQzbLF3i6Kfz6uspjkQp5Yl1nnGjYKHPDWs5vJL8xLt Uop1z9EghsGvsyNa0S0Xxsy4cYdecTHXKk5AR+pf44vK73THxs0e/SqcQimpfqe+ QqbLCGJWpHRvqLguUSyhkLHnPV70f0Kag/bmcqtKpI65In0W/TV+dC24qaPVuK5Y 7WE/7D4gjwVF3Tn6XxMhjJbQOvVq6wx0jF+P9qCHSbvtlLEj9hWnEM0Q/PW/W4oU bsnPlU8vOvpvGe0TfFhVEzweWsewpPT30Jg29tfvPUBOJyzM//WHQxrrWvBAHS8R wvA7nLPB6k+DiTi34eSlwIYIRgZogBWViJIBC9PrL8VYtd17v9Wkl4qnoffkiSon HBw+LHJ8z9mcbKENvlRVCVUhJvZ3SnwWOc/nBUf2D1hFeGSCrBFoG0s0qqkyHoib D1eL4rV8QruxRLn4AMgXj96B4LCrQmuU/rg= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/64C6200E6A613BF0

http://decryptor.cc/64C6200E6A613BF0

Extracted

Path

C:\g9zo8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension g9zo8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9EB01A2E78A544CE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9EB01A2E78A544CE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: czpKID8xgF96uzDRIenG8Qo1/f3kHDorii0MgayNFEjBwQDp0ornE2qW+KWOIMp7 zV5/UnE48kp/PX0gaDDqqJUXuCx7jmU4qbNK9/6yTbwr5S/v2sv75QCFA9t4wnIM XRcY++gEWSYTgMSeq/rmXAjJlD5bGsQVjzXy59q5spxvAO2dZun0MOk24s3+qICl N9+LBXUOgtQP0qYRJ9guxdBvLX7I9imMsGcP4uxXQUXbAzQN0YY9fx3nCU2WtMfX ukYyHaarx9OamJnJ1J3sGnldNucbzhneAofUUcTg8IdpfXszrcXQNzGHeLXqz56Y qVswGBVcly8j7mNuh7IHpmiahwFdss1KgkmBlGhL+DBwpLov9OUo8j4czUyVBnAV AgicykWo30uxp6HV7l2cv1nrBjMdzJwBQhpa2l8yunwIOydjzXLT3oNUu78fvA5U SDK4wggCehiAg5q3A5JHePgFSYtxi8en1F+p4+hdCSIB9KuHpI5V7Gen8l7N8YwM p0XUuxIWmaP1cngM+/dvT9UYUJgXXkugpqec8V1eT4iBgD9PnGuZ7KlYLNGprDcY cIuBaW02Bn21+QlSKPV7fsT3Ge0uSgz+c9pmzwEOE2sHiPGyxmM7lRXUll8Su6/6 /RSjnE0DnTgz3YKjIWRPDMFFSLqBjRzl5nw4os9BVzJrip8cWEUxN3wtCjds84S2 63ZuepB8mhDsgt+wSKAzKXxcFyBe2WYIzlt5gYQcc0UCjn0TIyy2KgEReKWfwnxR cf2BGUEBtSdHZKNmAzfaRwxblo6/lIQC+h7hJKP89AHMNcFDjXS4VoRWvuxK1rgr Vk+VoMUI0RqLSMeJu5M9JBtdF2dfpm942kwo5UP64dAO3mfdLSkoeDdvrYNpClbX tlht9Da9y9ocyjEWgnndEUQWzKouUroK1VcrlM3nDOy2ZkyttZjNPaZ0XQ5fNSms lHoGIPx9z1pXDos+Ag0yxRQ/aAJz/SAyegbcHfv6yigzwIAqnQzKJjFuHtPu+f8r 5743qlHf3Rccv5LKMNs6mTtNYaSrlA9NocjjnebaQsjZXNSuCwAN6MWMwblTHOgt KTRMRPOv6cQZGFn4jhkJPctl7IznKNG5us8D1vu6uFq8s/ZkPJN4A4NG/9ahjwjo VW//JpqbNnVkykYcv1qGvKyebCSyufco3665z1WhuzqrpUA7iwdb0cbThPyKQQli 9q3Y9qWncdGxHkX0eOhfMajt9SWGgG9TQHPiQVF5fkKiosAQyu87pelHRPYmpgua FhoBM/qN6PV4lPL1hPY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9EB01A2E78A544CE

http://decryptor.cc/9EB01A2E78A544CE

Targets

    • Target

      3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

    • Size

      166KB

    • MD5

      340b6f816bfdcfcb466cfc126c976844

    • SHA1

      e2e3adfcf621166a9f5bb7ee9795b7914cda2095

    • SHA256

      3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

    • SHA512

      3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks