General

  • Target

    b8a3da8c60459974767732321a29b91dfea59ab5ad993caf832f2bb2484b5c96.zip

  • Size

    17KB

  • Sample

    220211-w8cc7aefcj

  • MD5

    c05d45bb045c196472c7bc51f90389a3

  • SHA1

    197d33bda32ecc09aec730b7ba91a70d859a7a41

  • SHA256

    90561835c00d32961a5d49e4fc883e70a1685119e0618b93f7256c1b7e9baa0f

  • SHA512

    11f4d4cef7111a026250596725e8253c5462a489e238b011d683310892fcd7a9f906886b6a4b74463d3c3065484dc87366e735b426314f399f9aba1621178407

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\4agrfsh5tx7-HOW-TO-DECRYPT.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4agrfsh5tx7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://wwylgcvegp33t2ytnsqa6klroq3kz643q5ceinkqb7x6232g3guit2id.onion 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/913AED0B5FE1497D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: FP98YeJuPz0bim5rthPr2vO1vLwHs3BLgpIZ59VSUIhdj4cdiS2Ao15UAHMNsBB Vxo53efwuM7WtNvS1sTiaAAhotyYxwIkSGMp48j9CfIyqfMGPzVeYdlUwGRJpG8 7DXEmBFY2JUf41M1JhrJ7anLze13xrZT6hLvTbjEJbdVD7rdkPIm87BhaLOHKMk KtBjXqbhs8m9g6RH2xXShjxU8gnUHMb470TmCXUwJsZnV8ekIDWUw4Ck5ql1CGZ fgsCpnoFeclIzJJ9ABDLE0HHDxsrWwdtDS4Hn6y6e811LvNbvqlz94VoZk9257s s91FgPCVDMGrF9P6RkR5pLntI7PrC76BgQJ2UpqLtVhn3MQpKorRoCDgVH6j9US GPFLzzWml3FLUoA06rkhYPpWdMmhMtGMZCaXyBazxCFYj1s2URA2Zw41ksrmNzZ 2x3wSNmC5QutWJRxmeuM5tNwmHjxFTym8mNkpEaosOEmoDirT5FIdmeIjGKKoz6 lbHut5qHhDFeqokIjj1dKOqJVIFBj4Q92SdLhSyvnxhEXIxe88kkxVwXv8Yk0ph nxFlYLZkQvF0WqlvNVkClTpMggFZi3N48P4RShZTiXUzrfZqJMLPQm6TH3E1F9C XhK2HwUdp5RdO90eBHYQVr7oVTkKYchNiU6RhmR4ztfT8JsURYCurtqpjfhyMKE NYE43Ci7ZzeamLoqMkQ3AawgzoQrBFdrpoS54OyRsbn5NSDe5zUN6REwliFOw15 UWwv82tw8w9Kix1SglwwMuPvYkgTVIje1fSibhFlMCWb7Gf9uPjnAEtkGAXXWZa zMeTDeS19fKkJXxySFgiGj6ewwscaJrOwmhPcwcfbXjIzejMSLFS01TPP9hQw0b zx5xhziVfmBHt9xpSMfJPEZY5SR9dPLsl6uU3qCXuzjpztkPcTPDRrLvYh2Ohi2 QaSfwPdwlKIYZetjLsChJAIb4u86WxxzL7TPgOx98hn2JSwQp7rgfBsPS1lCQhZ xXSNbKeC74CilWPSl7rQYFQTJPD6pmvtbHzf0EUGK4umddG3DiAEiQBrG9DMGiX UITGdhtbgnlFdVo0qIK2GlqKLGHY0BI9mhZdJWmWTGdb7KhWcIXD5pQsbI4XZUk felc55KqTgyi9IPNBjv6snED7RqBBbP69g76VrlaRbDhHGQkM53xnY21aifoOJp 2Q1jdLS2U8UpQkg61BGzFicSlnFgwL6MI Extension name: 4agrfsh5tx7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://wwylgcvegp33t2ytnsqa6klroq3kz643q5ceinkqb7x6232g3guit2id.onion

http://decryptor.top/913AED0B5FE1497D

Extracted

Path

C:\Users\Admin\Desktop\4agrfsh5tx7-HOW-TO-DECRYPT.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 4agrfsh5tx7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://wwylgcvegp33t2ytnsqa6klroq3kz643q5ceinkqb7x6232g3guit2id.onion 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/913AED0B5FE1497D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ebTRuZo4SxYjplpHnA1XYEcEoDX1GXedeqDmT42ZU3lAWMEujHXaE34a8PnrBxy 5T4F8iCxsHbCecbrb8nR9ADZkvmnERKXhFqrcHFMhToSm0a8ghLtYgz4QeeN5Yt b7EfZvuPU2atpWuxuVoHgFb9APwb7m2RIkMViUAMwS007wJigru1QRMVfFfJ9TR r9JlFKYOZUbVNPkBNGN4P2BA0X00dz1McAI1yLEYHdUgy69G4ERCvYCy7JusThv jdP2MGtMCCzxwifL4Xt6ZhyaE8T3oaVEkruDjDwAK1PA6lPQc80UklWCoyyNwzh mqvMFxbl0ltvhSxectDaqkBe8UsYvPiNUTmUKYKdAW9t00yt1TVetZ0BoQOuED0 lCfaOpdTDijZUlSnIf8hb3Ee5clp3KZZ7gXrVajEX9R6J9gaWnGOFgYr7AewEyZ 3IKcyNkSr54JclIU65KSQELTaHqtU5x9jjYx9grNwUYSKX6Fzpi03fJz70Cqg17 wI4k2NVVZN7g5q2JDLk3oW6GDajzIeAq4XlKPxE2eUJm59NIFr8f68TZLygcnfN 4NRliEs3QGrYUNUKEMauagft6EM8bRmO9HPZoXpEWysYOj8M1obPNuwYshpe2tb 9edZN74frhVXmxGeXF9GxzWAOU1rGrLMmWt3vJvO6Its1XJklCSY2moJIcL2GNZ 9VJvPEMtNUvKpGoJ1LQFEZxT9skvT82HtttWrl4gZTEDHc9DeSTr0HUki0vgeaa Pbna6WRbPQtquVtMgthRAoLRmYJy10XC83zldCCqN1EaGbkPznOw7JZkQWxhNdj Y2rr1gHtdq0EIjuKLx48NllFzdOVGPfctRpiYtstr4uGGFQAfLltTeWxRm2YRwm OLXU14MvcFLRT1e8tMNz5nvJP52Qw1Ub5Sg4svZGTZJoIND5wnJME6qlaOF6B59 kutVAVkQ8wGgfdGBC26dJrIX9l4eeqdFXai4Y1CkMXLZ7aKHUMDEEbz2lWWYaGv RTBIF4LnKzVRwgtZjbwJSnZA5kpSBfoKGl3F6RFNIi2OsKDW27x7n6do4ANfO3l pLLLKnndRWjBtuKRvgTaErqhJIOL5Dj8P6NDh83sPeflE4u4utb84ch7eoBCZbh NwkvwhGtwnlKjLFcPXUbLllEwZPj370Sx6RydI7Wn9pUSS7vYLwoEAVlKf9XRh0 yxSXn4Q8Ga7xM6QvebdLsLMNwkpo7JkFG Extension name: 4agrfsh5tx7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://wwylgcvegp33t2ytnsqa6klroq3kz643q5ceinkqb7x6232g3guit2id.onion

http://decryptor.top/913AED0B5FE1497D

Targets

    • Target

      b8a3da8c60459974767732321a29b91dfea59ab5ad993caf832f2bb2484b5c96.exe

    • Size

      107KB

    • MD5

      40c01e02dd940c2b3ca1466799da68fd

    • SHA1

      daa2b8467edff06bf3f8cc926534bc088049a092

    • SHA256

      b8a3da8c60459974767732321a29b91dfea59ab5ad993caf832f2bb2484b5c96

    • SHA512

      831b89e00addfbd4e78d90e61ae6874ad6fbe4482099dbd894c4f23236edf72b5d0c86dec72a4f592f84b60e3d3f0797c1f1ae86aaa78d62a5d96ab6070ab2c5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks