General

  • Target

    0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e

  • Size

    141KB

  • Sample

    220130-jym1qahgh5

  • MD5

    bbc4b3eb90f4ff9f03a4d56171f0019b

  • SHA1

    051b7eb98447c7f8e7eb8d3628ab1382ded08034

  • SHA256

    0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e

  • SHA512

    f679bfd0baf769284f355939c809be865d0559d561af1850749a78c30a2d8a8e84ba5f046b9aeb9403acf181231d76cde4603d586708919896c1b331930b5ff0

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$1t/az7Ns5HxJsKGeu0uJee5f3P0x6ZsI0spG11uvr8PNt6IZDb9ge

Campaign

5223

C2

parks-nuernberg.de

werkkring.nl

memaag.com

strategicstatements.com

southeasternacademyofprosthodontics.org

thomasvicino.com

cursosgratuitosnainternet.com

expandet.dk

commercialboatbuilding.com

teresianmedia.org

evangelische-pfarrgemeinde-tuniberg.de

jolly-events.com

mymoneyforex.com

theletter.company

ontrailsandboulevards.com

modelmaking.nl

itelagen.com

campusoutreach.org

bristolaeroclub.co.uk

cursoporcelanatoliquido.online

Attributes
  • net

    true

  • pid

    $2a$10$1t/az7Ns5HxJsKGeu0uJee5f3P0x6ZsI0spG11uvr8PNt6IZDb9ge

  • prc

    visio

    ocautoupds

    thunderbird

    onenote

    steam

    isqlplussvc

    firefox

    agntsvc

    oracle

    excel

    powerpnt

    mspub

    wordpad

    synctime

    mydesktopservice

    dbeng50

    tbirdconfig

    ocomm

    sql

    xfssvccon

    ocssd

    infopath

    mydesktopqos

    winword

    outlook

    msaccess

    dbsnmp

    encsvc

    thebat

    sqbcoreservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5223

  • svc

    vss

    veeam

    sophos

    svc$

    sql

    backup

    mepocs

    memtas

Extracted

Path

C:\agl7i0g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension agl7i0g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B33C535B6FCB6D46 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B33C535B6FCB6D46 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rbwaS8K/6C8XAVkERM6NcQaew3TY0AtTruonR4zo3OTuzo16YpnyNkLmadATsvPJ Ee/+/onELfv9Zhm90CYdB86A33sVNtAqr9gol4/r1ztb7RjiKdvWCFTnWsJ28KhZ KNL3pQ8jMkhzzFMHbllcJhjlhqO460ENnMhvl2YegYF9Y00QbU2g+5b5LsT119cq HU9op7ZbX9yfCkAmDfvKMouevzkcITU3tTbRW5H+eF+MJNFBpE5GfslNjqLGSHUP vlMXSE9VrqtbPOAOVWecbgAtgmiimN4tcMt4V/vDzRYV1hSovUQXBcR/i3Gy1chQ x32Zy/FaellEQENsa9N7biq6zCrtjWnTXXIM0hH5IT+pw1aHQfaq1ZCz6GCCINd3 Sq1HIWsh6BPR7JOzC/PsBNaRg+n97YJDs6nCDEKSHEpWsptEI9MHJQk5rAr4YtGW DG2itMtYMy7RGIEWTHiLeQmMKfHKzSA0nLiXrP9vJ1JhNDoMVE5oM4fROSnWNNeV SdhAIPTsVsx9updttZJp8rRxLTFUSP0+CRbaAYM+24rLrR22Fg6tgH3/QZEwKhzT o74lKu+/M05rWh2iTVg8hu/4LbM4bdAb+kbpOWaA+2JrD5OIyOSQgxyfKhEcxOjW RT0atJ8MHtspDBTc+p4l3Kg1WUFnV9Ea1Fw0AYz+OIVbQ9X/rq+7zPUsAuySn8hU VNSR+W5d4P3bVTGu1ggx4ssM2qls/huMSUs0URmrxIlqKfs4VODXTpG5Mgx/3isJ TLhmgbVLkjp+vpZKNpOGIPrja84jdat7ypgG2WlhF8yuSgHY4lY42SUkUnk4qvTo lWi7f8bskFJN7CUmcqdKLItrWyH8CYv0nXvYJPS3cCwP0W2naSkyqc/hJqheUA6q F97uZtIqmilaVi62taI3iwFnfMzcTvx5O6f42JEWrgW+iR3Ik/IM6Dp8x+c2f3ZF 0jB/Iv+0JQxHa1tdqrrt/PaxP19LdK2RX1Tl7oSg0qH/HAk+RrMkZZUZR9OjCGeD 6/1VQWxBSeXycV5KNYTkO/vpunJTRF7GLqkJuRvhfOtQHN/+ubz3TPwMjF0pICc+ fHTpGYQbUv5TFh/CHoscUgjqxAnFEXoOvYU0cQwKhREnrQFV8rvK1STYlJKBOkvI mOP2c5kyhXKRLlSplNT5zoxp8i1+w3zHBNl+wgADxsJfFwtIESfR2rgnnvnXzYrs gyqKriv63F3wHiNuDyzsr5Q+XLUhdIVyx+kuw+h4IrEDHbac55eUqmwHYM95xY6s Wl2EGMQ+gCSHK2SOGmiz0VdmmknrsM+E37s= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B33C535B6FCB6D46

http://decoder.re/B33C535B6FCB6D46

Extracted

Path

C:\16xy5z3x-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 16xy5z3x. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0143D13C3C4165E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/F0143D13C3C4165E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: s7JT6ChfNpN1aL8Ey/sTTVRHyUSEtf3KA7tiFS/kYF5FFyHhKP+t1YfdVQYqefKB UyDO5DhdbyD7Pzw4Tr4s70ttMFMCmR4h4K9tNR2Wa2ntoJGHuAnvUZCswLf0ccS0 pM8arYoWbX2h7OvyupJbaPvUrccrwvxSNaBLtkvYkw0IM/4YqFYGJ7g/J2sQBrKa IEBoJR5uQsgygW3N1PFGEDWLOKeKKgT+lnAEolL5SkKrZ+jkpafZt9D01yp4QP8b pe5+UVCj+eWVsvxGLXjFvww7UuBk4Jp5kku1Pd/tKJw51No+htAzTiGHUy9r+GRN MVMgfk3VSvR7vSAUqfOqacoQeaiHGPDvOOAx0d9Aj6byEQhWHqFZOa3VPScwWmfh /CdiEDK27eLU+6J9Uib4StJRuQcGKUgjbA2Vn4sbsBtimwmESxSqCJFVrL2MrV3k 0y/EOhtSoDyrXJTU4gjTYZWYtVYkj0IxgD5VGqegwrv+h26gj64zkG4zicpSHZ+C A3nlaJrGOY0WA+cwVgYcpcyOw0ew7LChSiKgYii8cwQgsp/4xhaRo09YYjSI82pk /q3BkTR6Lglio2Q106Gsqm4htlKHLSbi19JsCmYEpbdw3ZFhQo0akrLo6FUJnuyz EtJVdWgzCPHtz4tfRupMVFMELJIV2H8ahRRBJalR4ktTa1D6T1UEbxhdLT+sHsqo zQHRQjZgj8Tpi4cjjbQ3TIuEvVxK+sv9bLc0THgA3P1Kb3Ivw7rml4cPDh5n4ntP awkreXum/catz+l/5z2mSUymkJd1Z1HJ4RfC3qe0N/nvagnX355HG7/dBqTFX+dr hzy9Vy7GUkYYb7M09tq7bdF1z9N9dkiY0R+b+kiFYFLLlFsXVowc4sPF1h0aNIVC lAaq1qeOqAPRpooPly2Kt37b0MvtUnQzjoDLXK+DEI0m4/OXOLb224yjhSD2gTAx fm8AmPz4V9/FHpeR4T3Eg0G5GdDtPFtZK4ctC9gGs5Cx1SmGuMvG8zYxJ6L8pR51 fscIVAX5pt2jgItqDBVGCQTh0GKJEIWP69RB5DLojm25EOS5J4S8jHKGGD/VFc3A KqcIrMyDoYsqiYJ72wtys17Tw8qu7cMzn5HyF5ZnPSNQ/3dayTXI5hoRuAhMg7tR J2zRlB7ux1f+7X/Jo9fdr+dDOZonspXN0YMpNzJyK6khv7saMXt2aBlc26dPJn8g 823n0u+k9Y94UUfXj8FzH83GTCOj8yUu3wiC5htPEo+88piMjuNJA3KIVKmlo6Rp hJEMEHX4VQsylu6syHEPrvuwmnA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0143D13C3C4165E

http://decoder.re/F0143D13C3C4165E

Targets

    • Target

      0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e

    • Size

      141KB

    • MD5

      bbc4b3eb90f4ff9f03a4d56171f0019b

    • SHA1

      051b7eb98447c7f8e7eb8d3628ab1382ded08034

    • SHA256

      0ea283badef01744073841b226d088362ceec617232e7cafce94b74f2525bb0e

    • SHA512

      f679bfd0baf769284f355939c809be865d0559d561af1850749a78c30a2d8a8e84ba5f046b9aeb9403acf181231d76cde4603d586708919896c1b331930b5ff0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks