General

  • Target

    6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0

  • Size

    257KB

  • Sample

    220211-cg5qwabcal

  • MD5

    72ed8933da777d1a3314737ec6f46d9a

  • SHA1

    bd255b1b76cf5a8efef5aab428536c99a57acc22

  • SHA256

    6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0

  • SHA512

    1b1e503c474a3435ca1859f5f3bb4ba9e791cd0c40aa5804e603c2bb5f6fb74f17fd8dd59011ed24b1568791c597c9a1cf3142f31792993bcdf26f21d3721596

Malware Config

Extracted

Path

C:\uf3ab144m-HELP-NEED.txt

Ransom Note
Hello! Your files were blocked due to a critical system error in your OS. Your file extension is now "uf3ab144m". Do not try to decode the files - you'll lose your data FOREVER! To decrypt the files, you need to buy a decoder for the bitcoins or monero coins. DO NOT WASTE TIME, you have few days to make payment, otherwise the price of the decoder will rise twice. What you must to do it is written below. If it is difficult for you to do it, search file recovery services in your country or city. Open the page in your browser: http://decryptor.cc/893542E32CBE586E If you can not open it, in that case download TOR browser (https://torproject.org/). If you can not open the download page of TOR browser, download VPN and try again! After installing TOR on your computer open the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/893542E32CBE586E And then you need to enter the following code: 4D43hUpgx1Z8+2GyMwckp1kmbWQZd2+8m2kcBEm2gN9BmO9xQYk308V01vT4p/+b pUsebord+NomkyFMiT3DHuJbt9lmMVRPet0nlYtLRh1RJWL5l9do2BvZsmXxzNSL Pj5mcXFSQlBunOYTlwrCWR3TnfDLBejfjp3kO8sfZ6+oMq+K8jM9Lg2kzgF6uIbo x5axxwjV3AF0afbEYFaEphcINz07JCZsizAe3jGJ4CviqmVJU4BM+DSmvb8JWbhk NOYjk7mtxBXOw06RCotUUIwmrF0lRQ1CoAdQrpnUSs8BX1mV1G2O6lrBagfpFc+n DTPXPVSIfWvPleHU6g3ieTDr/wgqM96ipP8OBpY2A6IzSeEMZ+sr0sWfU46u0rms 2+LgXuqBfOifN6DGZAzLVrIr+if/dsdbtc10sVdrbughOtufuNDROh++fH+bMbvP jKvjxzKE3oxJwSRXLGwS5Td0wfqNiwLASgL0MwNULJCusF0AdyJzUJ99OPzxHazi t6Zgvjc//BBLBcF4dU+v4ituzHK9CykhpiU+gY6UrZgYBXx95nv+bm47luMqufw1 kKJD5h6UesGKU4kGEVB9/3S8pH3e8tQdGWMhbUPtwUltP9Qt2RIVrcMJYktQezvx 3lUxjV/W3D7Ii3VcgtVxYalmO20KKDI2+b+YQmbAA38wOBVYPHZUrI70IOlPzVI4 ReKiBzNlbBU+zJeYFNcc8q1i8XdKwGVnF/sbDnUqzWPjVDI316fI8Yrjjz5BZqF/ UgLWWGhc5Pwv3Mk+KoFPovDFV10awhNn0VMHsXXyHWnW2tFaZtYKx52gbihGg8Ma PizAtxOEEQy4RygWuSOvWbAVP8OYm0WdcbTBjd0wYPRsJ5ilvQxrpHgUx3+c8kHe n4iOM54PJwSZuwzKoLGwzv5uCYD6qDoe1HVkSnTCoXGWlNHgx+Rw6+k4/y3pvgof 2yLFsvItCFwf2ykCi5spUI6oKnSg+8ACuQ2JwCB3d7/BAKGaYGLkO/QtcbuHI9QD +u8nU7oQtHUiKhXyOAYA7kHAJw5oGvVPHdVTwcwiErElpFy/F+V/lWKrok2fkBMP v/g+A3E0CAvenmt1zSqwud2CKSWhuREcPHZrTheFYLupzjjn8MYyC7Mb45OaWK8A 33q9uC3aDbkrZwoKTLYKidb8RTkPLmDpjlysm+g+GCyIkTTumSr5mQAGII9IY+LD 2+tH4xA+C76zeL4GHniG6/U5NiqNBNkCCceRxvPdKs67nvJjf8BTxY6g7BtpXCoc NEfpHY+47NR5GNtQZ0WczcJdKXSSI7x27QwaEWxd
URLs

http://decryptor.cc/893542E32CBE586E

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/893542E32CBE586E

Extracted

Family

sodinokibi

Botnet

$2a$10$Shx1LbA3xAA/xQXdIg7wbeRlSCl.wFmI0H1W9XK4tRyyiedSOnlrC

Campaign

3597

C2

rieed.de

wmiadmin.com

cwsitservices.co.uk

tanzprojekt.com

aselbermachen.com

drnice.de

adoptioperheet.fi

henricekupper.com

christinarebuffetcourses.com

nvwoodwerks.com

facettenreich27.de

craigvalentineacademy.com

turkcaparbariatrics.com

fizzl.ru

ontrailsandboulevards.com

ora-it.de

monark.com

visiativ-industry.fr

gasbarre.com

vibethink.net

Attributes
  • net

    true

  • pid

    $2a$10$Shx1LbA3xAA/xQXdIg7wbeRlSCl.wFmI0H1W9XK4tRyyiedSOnlrC

  • prc

    visio

    outlook

    oracle

    mydesktopservice

    isqlplussvc

    dbsnmp

    infopath

    xfssvccon

    sql

    synctime

    msaccess

    sqbcoreservice

    steam

    mspub

    agntsvc

    tbirdconfig

    winword

    thunderbird

    thebat

    ocssd

    dbeng50

    powerpnt

    excel

    mydesktopqos

    onenote

    ocomm

    ocautoupds

    firefox

    wordpad

    encsvc

  • ransom_oneliner

    ...ALL YOUR FILES ARE BLOCKED AND CAN BE LOST SOON... Urgently find: {EXT}-HELP-NEED.txt in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!

  • ransom_template

    Hello! Your files were blocked due to a critical system error in your OS. Your file extension is now "{EXT}". Do not try to decode the files - you'll lose your data FOREVER! To decrypt the files, you need to buy a decoder for the bitcoins or monero coins. DO NOT WASTE TIME, you have few days to make payment, otherwise the price of the decoder will rise twice. What you must to do it is written below. If it is difficult for you to do it, search file recovery services in your country or city. Open the page in your browser: http://decryptor.cc/{UID} If you can not open it, in that case download TOR browser (https://torproject.org/). If you can not open the download page of TOR browser, download VPN and try again! After installing TOR on your computer open the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} And then you need to enter the following code: {KEY}

  • sub

    3597

  • svc

    veeam

    svc$

    sophos

    sql

    memtas

    vss

    backup

    mepocs

Extracted

Path

C:\3uems08bv-HELP-NEED.txt

Ransom Note
Hello! Your files were blocked due to a critical system error in your OS. Your file extension is now "3uems08bv". Do not try to decode the files - you'll lose your data FOREVER! To decrypt the files, you need to buy a decoder for the bitcoins or monero coins. DO NOT WASTE TIME, you have few days to make payment, otherwise the price of the decoder will rise twice. What you must to do it is written below. If it is difficult for you to do it, search file recovery services in your country or city. Open the page in your browser: http://decryptor.cc/3F5E24108B0410D0 If you can not open it, in that case download TOR browser (https://torproject.org/). If you can not open the download page of TOR browser, download VPN and try again! After installing TOR on your computer open the site: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3F5E24108B0410D0 And then you need to enter the following code: lCTSKMTDn5/bmwAIn0mnXP5aBmKWobu7VBblJCWq4fLBOswSF/2TdkOI0spB58Xn wVhHG+Q/AwIM+tLvRM+5nxFngI0nEDt+LtqhhTQxgvUggwvCdMBceN6BKbF1/HRm N6VSvpP0dWE7Bqbu0Kxj0ITUVihjmWTKwVW4IL4zUW29fyewyELcTkD2XoUXMYEo rIDTHWcfnL7sKeKTqjRarPbyQagiVCc+BHMvgkY6F+D9kOC142gZNE+dMxXuQAiQ g+ZwBdwK+a0MKoEVGmj1bQgVRv4GQ/n5zGVCNrdLUFd/lsLXzozGKEtJbL/qs8ET fanMe1q2X7BiUhw4khPvzrLuv37WRQcLIrjrSug7ZcQ4T1/uEg6FHb8Uq8f2rgw9 bJJmK2/vWBQ2r7T+qrVSoWNi/3z88G9qGDYPwjPUEoLba6/F5tPvad36AM64DOJ7 uGn5sOMNZQU+zjhL7OWqeJ8IF8YhZSJLxgTv6hVbEKzaAZ7MMPiZZKiIP8BZ+ULO PhpM6HxqmM/3Thd9D1xLE4CLFILH7YI0+wW8sfnoNz1RQy52JpPCJpq4NSOSTRh+ smRr4Tgr7F8oHpBUE+zYbIwbJQBHkOO1AeawOZ4llvgzuzHnQiydokU5lGF6UOV7 T5TgSJGsIP+AxlmUU6ZWs1/VibGHjVewrg8T+ShnvAoDoYu33YICyNwtnKbbfjmR pZ1PK/5SJRCRuaK6uN3VS1qQqm/mjlLVzQ+mDLkun0WuEefUdgSoxp/DDBw6L96Y 2F++Nsd8LUyE2ML1h4WgQmA1HMFCTVW0/xqFh5BeGYmTJ3Ua4/oAhfSRUARo6yOg CK5upW9wY/SCQVJOCuyahZjX/TC9bKUE53ON/BRNBj3id5ajdm+Ho1wzKEz19qGM 6XHxot7ISdfnUQQvNiPUbc5eMqPNs7IGW2u/sB5a9m/aSb0125fCjKFznL68poPD wjJS6n2U5eP/zyBGjp7yMkEKS4C2D/kHtIWSBwcRCo4C8lvVOdHEUjHrKO2KCIoF Nvw3m5GD8oilGDbM4gCnuZq4cS9kRot3RI3rn9kIkXOHxiaBPQAcKdvRa2Qtvfjs JVI5ZUQ67L+x0CJeNnnk2fg8n0hKQyEBhM5R0/JBCpO8nlXKKcyHIX6hI4pnwWIx w04OmKu48NOaBDR4v4f2vDl/MOiAty4T33MvMpmRKMF9db5LbkW28UVTA9JE0W4a mefe4BifG3OnKeGdAtij9ULJ7moWC2WsYioFWG04/4eqEz8NEvKXWTX/ZrwBgaJw eYO4B6r3icOwwHTrj0YmGsdV1ttzhyTt2/Uw2XsgomqRwBDO
URLs

http://decryptor.cc/3F5E24108B0410D0

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/3F5E24108B0410D0

Targets

    • Target

      6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0

    • Size

      257KB

    • MD5

      72ed8933da777d1a3314737ec6f46d9a

    • SHA1

      bd255b1b76cf5a8efef5aab428536c99a57acc22

    • SHA256

      6b07e1550c25ecd0ffdcb908286ee9c941f58575d737642dcc00bd9d0cffe5c0

    • SHA512

      1b1e503c474a3435ca1859f5f3bb4ba9e791cd0c40aa5804e603c2bb5f6fb74f17fd8dd59011ed24b1568791c597c9a1cf3142f31792993bcdf26f21d3721596

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks