General

  • Target

    2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

  • Size

    206KB

  • Sample

    220124-ct8cjaacf7

  • MD5

    0220e281b135f0e32a2794fefe4e6aa9

  • SHA1

    05227068220cc142487806cddb262561a84e7538

  • SHA256

    2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

  • SHA512

    8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538

Malware Config

Extracted

Path

C:\41n10w-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 41n10w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73B88515419F2565 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/73B88515419F2565 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: BiTzWNK2xFj1cXIbqVkcVXMlIOR1SbAokcpyZ9h6TujDxVL3YDE/1oEJguszh0bF WEVL53IuvxxFMJU8Z3BhITofqf2dI9H9XcJXgXewhqTy4Z5DJTv/KQf75UYjAbkZ k2IJeIKJIecbxNE4PBycvPAfyPHpNkammngbux8wFlxXbFCs5KTcbv1DKcz2qrLu gmObsLwx3bwhO/sDUoBc/cqNqeN1fps5qJuALYAugaM9Ew8ilHqTNY6OHX7Ztsyi dlL5Jh37sMRxInqdSj61zj2kqEEI3gSLxB/JKqhZ0q29NFsYTBzrjXh+9ZsWTEMz UAwj9EM0E6YccY7UxyBCQfOzZAD9GLCL5QiSrUEShGo+Z4GVJmtV6++pRAY7HToX dDpmB4g2sBqYJMrf3DdYhjPU8W37junrp1l/GcT3DnhVQu2zPJfIm9kUxnaB+EdX ZlbDjyH4qIIJPhnUPu0lca/oZeARtEje/kL8706IfZ3zJymJ42NlVS3p3Cyn+mEs GsX76eJ6iuxJPRGbiIcqVVe14jSZfp2Ap58qIZILB3AEyd1jp2f8URMZJ4cgk6kW FSsosi6NxPtsbz1qPtBlUuVpqiXBAdDoS+wzi7iT/DH29HcdhMDuxypnDHN2Mxrc Pt72+kJbGahIdzYkqVRT0nJbQbJ1Eyh3wIU8Fvq1uBov2+WAjawIxe2F6lrlh3UI N5+WQ9GRqbXKEjPm8zciNsL+dKm5/iYRoTjk+nuIX0TpdSJkzIDcO2c7CjARrJnd /SRw9KcB1IOHlmbG0cJ3q/XQsR2Oc/clHlfGNBH/D7KjgJHZGdSaHogOVbxyzzoI OAo7GsVtcSM69pavCHUAm03WSnieGSfi8UPUfTXrnUnKKSoVjv7CVkmjpMs0ci7D X+L0TSYcsJ9oWGaFnCnLlBRGAsKiwneBqDt83NItn8uV75midez4qVDnCsSqy60C NiLNh9EdYgc6Gme+WoepOIS21fU8N7WljOSq+8QiToDRsJfHqZrSjZgQZuy3HTw7 tRA7gEAy5Q9NSiK7ALMyqLYgyPFgfzUTVJK3Frv//VP69jSXstDnw41OVmycIKBW 6VfTMXObYDNdjJyjV2jzeQCvMbOx6B6w7JhXveiqc3IAaxxbf+fXsJo5dHRpQd+D cfcKXQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/73B88515419F2565

http://decryptor.cc/73B88515419F2565

Extracted

Family

sodinokibi

Botnet

16

Campaign

2932

C2

premier-iowa.com

turing.academy

physio-lang.de

rarefoods.ro

palmecophilippines.com

ddmgen.com

omnicademy.com

baita.ac

cmascd.com

nationnewsroom.com

belofloripa.be

babysitting-hk.helpergo.co

tages-geldvergleich.de

iactechnologies.net

line-x.co.uk

richardiv.com

goeppinger-teppichreinigung.de

dinecorp.com

hawthornsretirement.co.uk

kerstliedjeszingen.nl

Attributes
  • net

    false

  • pid

    16

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2932

Extracted

Path

C:\wp8b39-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wp8b39. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/3918789EF4C00089 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 6h6M2j6IMvJqmVMtOsCKSqGr7yNH14e94z21T3vTDW0td9HzBYt8ca4B28/P+pUr S7EKv7lM/ZzHS4hbn0UvKcT94bH+oU2FCQogEU3MeOKhsJXpq614y97K9vvlkXR3 s5ZVaRjQ9ii9xDrJDcXWGGPczRxkHCo9EWtUt8Cc49EjTB1oE9xCGnvA4HXLLY/4 Llq4qeWM0l7n65NVsMiatQAUZcqLLuhnawVwA6VgdZu0b5wVKT90za3COaSx/z2r 2AJvIZJC9Dg3LmVYzWS1Oq7YTxhqvbx5Ga20+g+8wFyylfZGAUnLL7ekUn2qtTqb zZTMHYd2i0omriLwVuejfPoYK9MJ3pahvQcY/hnHYe9rSHXAKlzEPXFE+luOMToY zlIiT1SG32TDZ1wq9KmEPX1cVY3SiUQJFNBwc51f6rj+4q09EdsP75vApNVAxNuT S4+rCaF4+Yoa+PDrDqxXJSfHfdrHXbY/2sGpNWs4hQpzKI1Ze2wJcphCMJoVzA6q enn2oiabmx+lizuEr6rqpjyTmexGtL+yExMYMuKfc124IY6II4xix/5cjVBAOIhg Cd168ZQtjXX2+Ld/NlPZwGPehDDlAyUY1Cf+aUies/dowBlPDt3w2ZTy27bEqX0m 8In70W29YTRiqDCVf+BKp9EvMERXTHTWERW9UOf3ONwmI9W7zZk9eoYNXPpQHY09 WGhYmhY/wiMSuabXHYQBZ1jj6+MY4VdbNerCIu9Ga+t7lostwXXsvPTNBy1dLzhH s/L/yTqtfc73c/NevD/8fCIE9wd5RXRnzR00oaytU+HV8v2CiqLdmy488mXRGsA1 NdntFfwDcv8gaOJU9IOWK3BiRkSPREerz4fkz1JEap5xb5aCb3isdJC3zF73WGUf hGX8CZD/cGO2GLcbFsgcXsbTWA33voc5q5EypdickE6T4JceGztUFiYQbZxu9X64 360Ohb53XAkQec47LhfgiPNjc8CwLvyF9Bdkoij3JTtipbCuvggDS9u2kBcHcO9N h3scNZL9XmtOuvS+X+LXpe/yiA3S3MzipZUIdgmRDPyYslS++p11z4Cq64T1iefL +QMWEbofsj6Mn/B7WjgAIGs3wCmMkSJwFum10BsHL0JEaowympoZTsS8pwA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3918789EF4C00089

http://decryptor.cc/3918789EF4C00089

Targets

    • Target

      2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

    • Size

      206KB

    • MD5

      0220e281b135f0e32a2794fefe4e6aa9

    • SHA1

      05227068220cc142487806cddb262561a84e7538

    • SHA256

      2809a1b475ef2118a5f6be8320f2015744bb5ce890241049c0055f9f2a3d373b

    • SHA512

      8e4d475bbea73f16d72079d329968aab1de73cf376f1a5988e7c5edd7824b23b29b8cb878da25e366fa98b69a4fe9fff30e912ad80172f51bab7c1bf0c008538

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Defacement

1
T1491

Tasks