General

  • Target

    b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f

  • Size

    1020KB

  • Sample

    220205-m4tx1aahcr

  • MD5

    4ff61b61152349015403583476eb22e1

  • SHA1

    82cd4c648589490a955c895e7bf3500d0d6a39d9

  • SHA256

    b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f

  • SHA512

    0abcbc189d5deba67ff5e5b670c1d6dabff1fd0292a87526dbc02d9879ee77ceb579ccec244f1f853a7aa23ecbc39a781aa7884dee189776593d7c0ceda39113

Malware Config

Extracted

Path

C:\2z745-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2z745. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6FA46D9EBF98ACC9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6FA46D9EBF98ACC9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 7uCKv0cfohUZYqEWKkUG1ca+WVm0HqBezoY8m5TKNQBotCb0Y6Nq1jAsl4fDWTnM HOXMZ/kbCUNotJjL4yjBrM5eLynRoDA5L8z5SOo78nXv0dX/ahRtD655j1C9LzpC ANd0qMMap0+4Ikayg8HG8U97hmXRH8UjE7mQ1Bml/23umC0vnXchoOz9s1mZ7MOQ OptQ14GQVwxYAhqqUrmHNB16rNyQHm2IDTP2ZXcpUhXYa4XMAp5FId18T2BPJdbl wGmrN7VFnDY+kP/9pmZiUTAmrzxbeHtyNHomYrbfZnUx1JC/fEOwW/9AIrbME+jz 4jdQg6McjVbnp4chw6TepfAoiJV0k3uqgndfTFNReRPdo8OFs8ZU/sgCUXbZPLP5 aoMY+h2FI4HmNorTmw0sTe0k6hnSW2jhiPZLnQOBmD6JL+h5purbEyZRmSyZ0//W lT/JS0j+Ja917N+HztcTUeujKAuBz1mah9ckWHxMUeIZ5JiuVBQnngfsOoBNn+e+ HmIx/wSInH1xJTAoUHYfkSOitEtLWd+cWXYAf4dC4H93k6ElN7KyBOSi7tY53+mL smH/DWKdFjxZWBsFZN5+rlZoK7zmg2FqV3EmlMpqKx9dsITLuxehQ29hf3MAfziO jKYOcLytQXdIJ9pD4FvIymgpcLtqNZ/0H0QBAgrz3kvXy0HaM4CxmlDoQbeExryo Lp3W2A+9VKdSS8pvJJVUjqChlsx9VHDH0zC/NTx1ldOeZaAROuThGbOuzJGsQzBM RKFImdtNFeDjXBf7XA4rsA7/bF6o0/a0yqQyLQxFYn7pWVHSG+/GrPfT+bSHeLuS hAkZ2x36nDLhwkpieiO3k5eZFbMDLPddkwrwaZ0usvNVJCWlx0sztzCFt6CPtU5v W6x0+Z+aTnoIUgUau4i7miIXX3paCXmm8sCug9FLb7ctiUw66H8irPelZ5ZyB7dH kRqKtOzkcFQZhXsFuhjMuX1izW6g+C1B/LxPiO8wE/s16htq+kQRfBliamKgloeO pLVYAcdHj1xvkdzwrsGoatmd+Luff/tVklmLtrC/OueyK/AQR7kN/rS9k445x9Zm oibxjjjOmOVNK4KMhE7MdbbrtFXwFofawmQ1Jfw2okCVrPTPXACeE68ZtuijdIxq 0PRJ0++DVjAryNQNKTWk2SC5tiUWdrfoBOpl5MAU69g0g/YOLaMvtXovOUX9//2p hA+++P/0pNskkKFeOwo2+cLJkxnQ84xmWHMuTFPVu1TEl8n01ma1cbW+S3HKZnt9 GAHVoRzPUEIJtjYMLCcjiQtGcDZGzA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6FA46D9EBF98ACC9

http://decryptor.cc/6FA46D9EBF98ACC9

Extracted

Family

sodinokibi

Botnet

$2a$10$sQQAXcJLnqNgqvfbBT.JZefPtOYCkVS1wlwp.OwG4hG.H2w0ZhKNa

Campaign

3902

C2

polzine.net

smithmediastrategies.com

spacecitysisters.org

irinaverwer.com

gw2guilds.org

deepsouthclothingcompany.com

rimborsobancario.net

kingfamily.construction

moveonnews.com

ampisolabergeggi.it

daniel-akermann-architektur-und-planung.ch

odiclinic.org

comarenterprises.com

nmiec.com

penco.ie

pmcimpact.com

dontpassthepepper.com

sobreholanda.com

gaiam.nl

caribdoctor.org

Attributes
  • net

    false

  • pid

    $2a$10$sQQAXcJLnqNgqvfbBT.JZefPtOYCkVS1wlwp.OwG4hG.H2w0ZhKNa

  • prc

    dbsnmp

    bengien

    VeeamNFSSvc

    thunderbird

    visio

    ocssd

    DellSystemDetect

    agntsvc

    bedbh

    benetns

    onenote

    encsvc

    EnterpriseClient

    excel

    CagService

    raw_agent_svc

    pvlsvr

    outlook

    mydesktopservice

    mydesktopqos

    powerpnt

    thebat

    synctime

    wordpad

    infopath

    msaccess

    VeeamDeploymentSvc

    mspub

    ocautoupds

    VeeamTransportSvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3902

  • svc

    CASAD2DWebSvc

    VSNAPVSS

    CAARCUpdateSvc

    BackupExecDiveciMediaService

    BackupExecJobEngine

    BackupExecAgentAccelerator

    BackupExecAgentBrowser

    backup

    MSExchange

    bedbg

    svc$

    PDVFSService

    MSSQL$

    stc_raw_agent

    mepocs

    VeeamNFSSvc

    BackupExecManagementService

    MSSQL

    memtas

    sql

    VeeamDeploymentService

    VeeamTransportSvc

    MSExchange$

    veeam

    AcronisAgent

    BackupExecVSSProvider

    MVarmor64

    AcrSch2Svc

    WSBExchange

    MVArmor

Extracted

Path

C:\1a2d1a4ayl-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 1a2d1a4ayl. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/89E963F29B1EF93D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/89E963F29B1EF93D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: UreQ/Ji7msqIeFEbdDwOBPmuZfi/dnUQNGy/y5B/785c8PVp2YZ/9LVUMtpB7A2M 9I/Hhi4pX3fVnI7+RZwP5rKPeK52cVqnyW3eRMV8AbaZRi+KhsqOXPwm1ryvuGnF 1LIKPUum5AGywvxSzKf6OY0yWt3CzGiDosBScPFVTv+sLEw5uVKsGyTCB9wYGbwg +qGOJlpKBxYkAnGcMiqRupW1H6ji42sygvHiJ5bEBia0CU8gZdLT3A0tPqIW8cS+ FLY9QK8zx90ws4F5ffgY57/nniz80CA6JiLp2/CiLB8zNzi+VxDJytSu6Le3erFO mIN3FxqclBDAax0SeyB65SveXVh4vV5wUGIyN/ACh7LWXd/1ktjIH9pbHheEch5r tuGYDrlHnzs93RlEvgiosWL2tnlUgYSOcapjuNkrtibnM3pfUyobIgqmtQqTimKb fji756VU6jXO50fHLfq1clahxZjTiop28qM7Cm7HgEqs/Ren9VFzskuGu6L5B0lb 4BVXyUWrynXBDNXOd8v/WIp6Zj/gjfCR+Yg1dMCJXLbD15PGOqSH6m4P4oTpUKnY oI20d9N4JyVszdxQnBhpJKE1iq4T+ER9P2Rwu3hMV33GXophiIdAkwEciuHGNn7D 0Jgu47HGidQNVsaQ2O5nbDRteZL/YPSK7cIPg9MVKTQntr1LFCZeyNw0oD6VKkgW YzV4h6O4psos7sSLMuadHmxDdFpAMaFM0wyeyAKQGuSzhgPxLXseB1GbUfumTc1t MkVFPMPoIroeH7tHsJvnzOVj5z0Cu6jZyKsgRoMFlI8Do7eA/jUUbPumy8wvOhI+ hUxa/I5OZLwZDSsMy9p5xtOgOi3SOTBCoCtcGik9JqYlylsB7NxmP8ppkmyTX7t1 q3LbESTJKI63c6X9mTHGwrVcHn0RSrHVXMgR1IcjpZIOoRfZacrRHAA9hMqOA8NO fzWO9OxLQQpXE6w03NXDtvfO4vBF6Mr5cBRzulGq7spNaSKZk7vm6YyqoPBqd7ka wP+LP5dbRyzPxlAvbgfHwDDSRPVdBvSkdNmMg9OTVPtJ/wTIdd9+PdJRxUi+DvmH nSlyYRjAtHg7mzgi15XYbtT/jfYaxH1X95WrZ0d3pdj5BbdDstK98Y1XB745JKAr Ot8gzi7k6c8+Nc/oPf2ewYntSOQ6ycqgEzmG3iPqf+T/qs/B7uBqdnYyor90Vznr /YvlR4tQ4hSIt/FVJ9MRmx36omCJTeCwUq+320/EbciM7VbcvNfzCanrTVIc5tZm x8HoPxV7ykuIyHVYo8hi6klof8c5qd+h2dPaWStclQtPDz+33dk= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/89E963F29B1EF93D

http://decryptor.cc/89E963F29B1EF93D

Targets

    • Target

      b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f

    • Size

      1020KB

    • MD5

      4ff61b61152349015403583476eb22e1

    • SHA1

      82cd4c648589490a955c895e7bf3500d0d6a39d9

    • SHA256

      b6929c10554b2ec977acdf9dbe47dc28fc35fb67c0fbaddca9486dadc72d545f

    • SHA512

      0abcbc189d5deba67ff5e5b670c1d6dabff1fd0292a87526dbc02d9879ee77ceb579ccec244f1f853a7aa23ecbc39a781aa7884dee189776593d7c0ceda39113

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks