General

  • Target

    23d96b2a01d190a2146849c6cfe59fea9f3c6c6a8f71367dacaf89d3fa1ac51c

  • Size

    165KB

  • Sample

    220130-jst7vahgb4

  • MD5

    46357f434f7a6af45d039812360c5fb4

  • SHA1

    413637aa0d885aa3f35aef237d04c549d74b1d89

  • SHA256

    23d96b2a01d190a2146849c6cfe59fea9f3c6c6a8f71367dacaf89d3fa1ac51c

  • SHA512

    b48c571d0bc28eae58426eebee334baa49a78eb6f19a2efc31997233cd97caa914356657980222e0acf9eb982b45978ab103168c11f5a5964edce628816b3089

Malware Config

Extracted

Family

sodinokibi

Botnet

48

Campaign

2839

C2

fotoeditores.com

lisa-poncon.fr

loysonbryan.com

levencovka.ru

dierenambulancealkmaar.nl

apogeeconseils.fr

xn--ziinoapte-6ld.ro

mrkluttz.com

larchwoodmarketing.com

cymru.futbol

afbudsrejserallinclusive.dk

towelroot.co

frimec-international.es

fluzfluzrewards.com

liepertgrafikweb.at

sppdstats.com

happylublog.wordpress.com

kelsigordon.com

biodentify.ai

bratek-immobilien.de

Attributes
  • net

    false

  • pid

    48

  • prc

    pvlsvr

    dbsnmp

    VeeamDeploymentSvc

    dbeng50

    beserver

    bengien

    powerpnt

    bedbh

    EnterpriseClient

    ocomm

    outlook

    thunderbird

    thebat

    isqlplussvc

    steam

    infopath

    tbirdconfig

    xfssvccon

    sql

    onenote

    mydesktopservice

    DellSystemDetect

    visio

    sqbcoreservice

    msaccess

    ocssd

    raw_agent_svc

    oracle

    vxmon

    excel

    ocautoupds

    mspub

    benetns

    VeeamTransportSvc

    agntsvc

    CagService

    wordpad

    VeeamNFSSvc

    winword

    firefox

    synctime

    encsvc

    mydesktopqos

    vsnapvss

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    2839

  • svc

    stc_raw_agent

    BackupExecAgentAccelerator

    AcrSch2Svc

    vss

    backup

    PDVFSService

    VSNAPVSS

    VeeamDeploymentService

    sophos

    ARSM

    BackupExecVSSProvider

    memtas

    svc$

    MSSQL$

    BackupExecJobEngine

    VeeamTransportSvc

    VeeamNFSSvc

    mepocs

    BackupExecAgentBrowser

    MSSQL

    CAARCUpdateSvc

    CASAD2DWebSvc

    BackupExecManagementService

    veeam

    BackupExecRPCService

    MSExchange

    MVarmor64

    WSBExchange

    sql

    AcronisAgent

    bedbg

    BackupExecDiveciMediaService

    MSExchange$

    MVArmor

Extracted

Path

C:\fm13y283-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension fm13y283. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0066B6C34257BA3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E0066B6C34257BA3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: bpvP3vo0rHE25tUE5WJReyuKgsNFAbsQBhreq9HYqxPWa2zaEJdLnxMUbmhzk61U fapBWy3oPFQn+v1Ere0WpyIGPEByUo2Cf2SI/K2e40eOM5AIDwwrnMSQR+ep5qw3 szA/PDPIq+HyN7O/PiyESP3cYYUWFjisU+botY85oC/4AkRWO9i2+wYog4EWoOkN V3AJi1PT8KQHqvnt8eTSEZkRWwnV8Pv4LLvfgGSFIcryThT7FHiAkFs4ak5TpZpZ 8hJkv9iNRJqFHyvhtJD31sAsJ+4C1VGo1CzpgE1kJshtabGu+Swm8wdZw4I28K3d mK0rm6f6sAd+/0tQxBBMCAXzPmWM5j7D/sIHvpKrYx0o4cYhPj+HO4ya6iFbyA98 QsWUbnD3qS1K4zbX2pypJz/75ayWp1GU7+yE1tPkpuGX49Yque1haBZfsYeJGYxH 6tmZDNCa3fzvgRn0gTBYmOHbgrftDrLboz4JKru9OBgeYzthSwKaV0QswbTcZD46 1qJy7lUJZ83O/edyPM6tsfxL2yZb2lo5hfNw+2O0FQTi9JDQko/fkwVlWF1ydqNs sFea2ETZZM+K4QDxXPPEmT6r8flIil9azWc7D3QURXmT42i9P99eWizfirVfkADp TBdBhiFnzaohINHaJHjHwZm0KXmnGjr9ETyQd4uClVbnqfvzh+tRouPf0BDla5ZV gDANs1cUkQK9tZLfTy1AJCj/aeHbfrgAeNSOQ0WS4j6gfGmlBaN7/d5QDXwjLEBK Uazjh6Ts1nd5gwyinCKxlBDw7oBfD0dlwQLmeF5QxtwWnrHQR9H/kSeH+YTN9Iji 3yE+siDwJs46ZZ2Lo2dfdPXdHsLKUKz2j4tagUioLBjYjzaXCNEGoKxN+7vOY1HO JIbY/KkaLqIBW4kj3cb6hp8sEBwYEawCI1j4Y7iY4d1OpX/Zt2Ydd49KWEOkZ0xo lqaNICYKT8c+OwiREWepZwFj0xMjRieidGMVkhJ1Ys930Z76Me/Un2t60LCekPry pfeExdztx2c9gRFdATGm+mPfRbiwmEH7YIDcc+/xCcLym4/EL4fVJ469nxGA860K YgQAD5luLSaZKMz6NjX5JS3++B8+vCN1VZqiANjurX22sx1yMRF8WTWTBpMQfiUm pGpSseMLG10= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0066B6C34257BA3

http://decryptor.cc/E0066B6C34257BA3

Extracted

Path

C:\9q1zg6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9q1zg6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/116A7C8FB1C82C25 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/116A7C8FB1C82C25 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QmvgBSjmJpmcqzQJDvOrrMa4OBekQkPAUw/L8TSQGwoBcB8e87vtPL+UX7sg51/K 0o1h9DzvzWlw04Nv7MIbkhipB9sA9h5hwyIokhMaZYDAqVSSfhPr4lub9EXTeu3V /raX5u5OCpE44H5C+4qf1RvMKGjsVOXBH7r4uI6OcEZtS9p2n9/WzKZ0KXLqQH9K awv1ws+6h74fo5ChzuaQcGpwv8UXKBNRu2dVJ0UWS0AZxqDKf+51TR56ciFrPHn2 /Ji4H93K6ygvOof8jR+J+86TqPDC9J6cP1NgAV1JJ7LF/y+SNRuhCzIxEP/pJ7vu Vny4dKv22XI3VHlg5dVerA1XQvdCdNtWePUq6TufQlh515Xn+Kspi7mFefBn8KQu a9kyi4EqXj5CtN/GVxFoY5EE9TEu+cxOXlqaZuC8Ee8GmvBfTGQh07jjmEOrNUoD wI7B/oFSY98+erQqX9UeQ+Kk+SE7qKpUHW3zXIpwbpr8V0/BRpp1AEfRt+sPzVLV 01nY8dvzacueiZ3e1qXddQreW9kjjEDV6NSEIPdk798ZyHySLFoaCYNbL+KvBOjy EMQRrrlxbyhw9wlmHervF/EJ9j+FAHS5fmF1RWd+GdoQ07N0ocKlymjZrBNFD+yh 8taXW5zpx6lP4UazJ88c20SMPkbcF/5FVBgSOr3Zf2CfeeZ7D+uydKP8toTMzfmO +KWG66KAYGEemTzwlLbSUPu4mTHwq213IxlsvTYZ6exeqB/il5E+lzF5Y8G2FyGB 1l20WEkh7VA6OyG3POuZFK7Tw71usHImrEuE6Nq0CiTGRTHWfyd6zsLfkoTaUdqn NkoHyee17LZHir5q4DCRV+4PqV2hSAfh2r/hlUfEhRA5p4yrP+WBVVpvk4Lp4jn7 kW9nroDV1fboWiQguJY16l7vLOoaTfe0Ke8JCTSQ+i7V1ho49ctEi89RazimwW3+ CwCAUnRtrwPoPBRSyi1I94rgV+KhTO1yBtBj3wAExFYOUudlpHQlh8qGokScGHtx 53gpBcqBpdwBK8tM7/FFtj+mCqmGnK2J+6/2p4YL4G4TXlaNUxO/HcrnvjnYB4Wz AHO0AsAY9adRJmeFCSGjgsb8tCFlqERj2JoyLKuEbSw436kcBr0OKbTPbGQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/116A7C8FB1C82C25

http://decryptor.cc/116A7C8FB1C82C25

Targets

    • Target

      23d96b2a01d190a2146849c6cfe59fea9f3c6c6a8f71367dacaf89d3fa1ac51c

    • Size

      165KB

    • MD5

      46357f434f7a6af45d039812360c5fb4

    • SHA1

      413637aa0d885aa3f35aef237d04c549d74b1d89

    • SHA256

      23d96b2a01d190a2146849c6cfe59fea9f3c6c6a8f71367dacaf89d3fa1ac51c

    • SHA512

      b48c571d0bc28eae58426eebee334baa49a78eb6f19a2efc31997233cd97caa914356657980222e0acf9eb982b45978ab103168c11f5a5964edce628816b3089

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks