2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

General
Target

2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

Size

206KB

Sample

220124-ct8cjaacf7

Score
10 /10
MD5

0220e281b135f0e32a2794fefe4e6aa9

SHA1

05227068220cc142487806cddb262561a84e7538

SHA256

2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

SHA512

8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538

Malware Config

Extracted

Path C:\41n10w-readme.txt
Family sodinokibi
Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 41n10w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73B88515419F2565 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/73B88515419F2565 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: BiTzWNK2xFj1cXIbqVkcVXMlIOR1SbAokcpyZ9h6TujDxVL3YDE/1oEJguszh0bF WEVL53IuvxxFMJU8Z3BhITofqf2dI9H9XcJXgXewhqTy4Z5DJTv/KQf75UYjAbkZ k2IJeIKJIecbxNE4PBycvPAfyPHpNkammngbux8wFlxXbFCs5KTcbv1DKcz2qrLu gmObsLwx3bwhO/sDUoBc/cqNqeN1fps5qJuALYAugaM9Ew8ilHqTNY6OHX7Ztsyi dlL5Jh37sMRxInqdSj61zj2kqEEI3gSLxB/JKqhZ0q29NFsYTBzrjXh+9ZsWTEMz UAwj9EM0E6YccY7UxyBCQfOzZAD9GLCL5QiSrUEShGo+Z4GVJmtV6++pRAY7HToX dDpmB4g2sBqYJMrf3DdYhjPU8W37junrp1l/GcT3DnhVQu2zPJfIm9kUxnaB+EdX ZlbDjyH4qIIJPhnUPu0lca/oZeARtEje/kL8706IfZ3zJymJ42NlVS3p3Cyn+mEs GsX76eJ6iuxJPRGbiIcqVVe14jSZfp2Ap58qIZILB3AEyd1jp2f8URMZJ4cgk6kW FSsosi6NxPtsbz1qPtBlUuVpqiXBAdDoS+wzi7iT/DH29HcdhMDuxypnDHN2Mxrc Pt72+kJbGahIdzYkqVRT0nJbQbJ1Eyh3wIU8Fvq1uBov2+WAjawIxe2F6lrlh3UI N5+WQ9GRqbXKEjPm8zciNsL+dKm5/iYRoTjk+nuIX0TpdSJkzIDcO2c7CjARrJnd /SRw9KcB1IOHlmbG0cJ3q/XQsR2Oc/clHlfGNBH/D7KjgJHZGdSaHogOVbxyzzoI OAo7GsVtcSM69pavCHUAm03WSnieGSfi8UPUfTXrnUnKKSoVjv7CVkmjpMs0ci7D X+L0TSYcsJ9oWGaFnCnLlBRGAsKiwneBqDt83NItn8uV75midez4qVDnCsSqy60C NiLNh9EdYgc6Gme+WoepOIS21fU8N7WljOSq+8QiToDRsJfHqZrSjZgQZuy3HTw7 tRA7gEAy5Q9NSiK7ALMyqLYgyPFgfzUTVJK3Frv//VP69jSXstDnw41OVmycIKBW 6VfTMXObYDNdjJyjV2jzeQCvMbOx6B6w7JhXveiqc3IAaxxbf+fXsJo5dHRpQd+D cfcKXQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73B88515419F2565

http://decryptor.cc/73B88515419F2565

Extracted

Family sodinokibi
Botnet 16
Campaign 2932
C2

premier-iowa.com

turing.academy

physio-lang.de

rarefoods.ro

palmecophilippines.com

ddmgen.com

omnicademy.com

baita.ac

cmascd.com

nationnewsroom.com

belofloripa.be

babysitting-hk.helpergo.co

tages-geldvergleich.de

iactechnologies.net

line-x.co.uk

richardiv.com

goeppinger-teppichreinigung.de

dinecorp.com

hawthornsretirement.co.uk

kerstliedjeszingen.nl

ahgarage.com

endlessrealms.net

5thactors.com

myplaywin3.com

apogeeconseils.fr

jacquesgarcianoto.com

traitware.com

alnectus.com

eatyoveges.com

protoplay.ca

paardcentraal.nl

electricianul.com

gta-jjb.fr

ilveshistoria.com

testitjavertailut.net

phukienbepthanhdat.com

georgemuncey.com

invela.dk

pilotgreen.com

coachpreneuracademy.com

medicalsupportco.com

lyricalduniya.com

mustangmarketinggroup.com

uci-france.fr

sbit.ag

mrkluttz.com

tellthebell.website

agora-collectivites.com

rozmata.com

jefersonalessandro.com

Attributes
net
false
pid
16
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
2932

Extracted

Path C:\wp8b39-readme.txt
Family sodinokibi
Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wp8b39. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3918789EF4C00089 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 6h6M2j6IMvJqmVMtOsCKSqGr7yNH14e94z21T3vTDW0td9HzBYt8ca4B28/P+pUr S7EKv7lM/ZzHS4hbn0UvKcT94bH+oU2FCQogEU3MeOKhsJXpq614y97K9vvlkXR3 s5ZVaRjQ9ii9xDrJDcXWGGPczRxkHCo9EWtUt8Cc49EjTB1oE9xCGnvA4HXLLY/4 Llq4qeWM0l7n65NVsMiatQAUZcqLLuhnawVwA6VgdZu0b5wVKT90za3COaSx/z2r 2AJvIZJC9Dg3LmVYzWS1Oq7YTxhqvbx5Ga20+g+8wFyylfZGAUnLL7ekUn2qtTqb zZTMHYd2i0omriLwVuejfPoYK9MJ3pahvQcY/hnHYe9rSHXAKlzEPXFE+luOMToY zlIiT1SG32TDZ1wq9KmEPX1cVY3SiUQJFNBwc51f6rj+4q09EdsP75vApNVAxNuT S4+rCaF4+Yoa+PDrDqxXJSfHfdrHXbY/2sGpNWs4hQpzKI1Ze2wJcphCMJoVzA6q enn2oiabmx+lizuEr6rqpjyTmexGtL+yExMYMuKfc124IY6II4xix/5cjVBAOIhg Cd168ZQtjXX2+Ld/NlPZwGPehDDlAyUY1Cf+aUies/dowBlPDt3w2ZTy27bEqX0m 8In70W29YTRiqDCVf+BKp9EvMERXTHTWERW9UOf3ONwmI9W7zZk9eoYNXPpQHY09 WGhYmhY/wiMSuabXHYQBZ1jj6+MY4VdbNerCIu9Ga+t7lostwXXsvPTNBy1dLzhH s/L/yTqtfc73c/NevD/8fCIE9wd5RXRnzR00oaytU+HV8v2CiqLdmy488mXRGsA1 NdntFfwDcv8gaOJU9IOWK3BiRkSPREerz4fkz1JEap5xb5aCb3isdJC3zF73WGUf hGX8CZD/cGO2GLcbFsgcXsbTWA33voc5q5EypdickE6T4JceGztUFiYQbZxu9X64 360Ohb53XAkQec47LhfgiPNjc8CwLvyF9Bdkoij3JTtipbCuvggDS9u2kBcHcO9N h3scNZL9XmtOuvS+X+LXpe/yiA3S3MzipZUIdgmRDPyYslS++p11z4Cq64T1iefL +QMWEbofsj6Mn/B7WjgAIGs3wCmMkSJwFum10BsHL0JEaowympoZTsS8pwA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089

http://decryptor.cc/3918789EF4C00089

Targets
Target

2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

MD5

0220e281b135f0e32a2794fefe4e6aa9

Filesize

206KB

Score
10/10
SHA1

05227068220cc142487806cddb262561a84e7538

SHA256

2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

SHA512

8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538

Tags

Signatures

  • Modifies system executable filetype association

    Tags

    TTPs

    Modify RegistryChange Default File Association
  • Neshta

    Description

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    Tags

  • Sodin,Sodinokibi,REvil

    Description

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    Tags

  • Executes dropped EXE

  • Modifies extensions of user files

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

  • Loads dropped DLL

  • Enumerates connected drives

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery
  • Sets desktop wallpaper using registry

    Tags

    TTPs

    DefacementModify Registry

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
            Initial Access
              Lateral Movement
                Privilege Escalation