General

  • Target

    dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c

  • Size

    116KB

  • Sample

    220305-2gel5ahdh8

  • MD5

    6cd56946aa6245d1eac3a88d4470a40c

  • SHA1

    b4635b3f442e3541a92f026fbb108abeb5d67df7

  • SHA256

    dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c

  • SHA512

    4dffd58030258616b5123246d88abc4f2444aa0cc2809cb3cdcc81e01beaaa1ea784c5e7b969c1982ecd938041e658300c24a67049fe868f4b172a55311dbd8c

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$ShjYFvDg6xizMbY9/HwsJeCthIXDgZWFCGCf6bUK3G65MhHmu3WhW

Campaign

808

C2

faroairporttransfers.net

rebeccarisher.com

richard-felix.co.uk

lbcframingelectrical.com

lubetkinmediacompanies.com

1kbk.com.ua

microcirc.net

cimanchesterescorts.co.uk

klimt2012.info

irinaverwer.com

stallbyggen.se

htchorst.nl

victoriousfestival.co.uk

centuryrs.com

123vrachi.ru

ianaswanson.com

miriamgrimm.de

eglectonk.online

mikeramirezcpa.com

bloggyboulga.net

Attributes
  • net

    true

  • pid

    $2a$10$ShjYFvDg6xizMbY9/HwsJeCthIXDgZWFCGCf6bUK3G65MhHmu3WhW

  • prc

    encsvc

    dbsnmp

    ocomm

    onenote

    isqlplussvc

    msaccess

    winword

    excel

    firefox

    ocautoupds

    sql

    sqbcoreservice

    mydesktopqos

    powerpnt

    thebat

    oracle

    infopath

    mydesktopservice

    thunderbird

    mspub

    outlook

    dbeng50

    synctime

    visio

    steam

    tbirdconfig

    xfssvccon

    agntsvc

    wordpad

    ocssd

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    808

  • svc

    memtas

    sophos

    vss

    backup

    mepocs

    veeam

    svc$

    sql

Extracted

Path

C:\mr3d7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion mr3d7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E50508EB35E0A248 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/E50508EB35E0A248 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: M14oAEBuzGbyqAjqhraBW0Y1L9tbtX/ijvcIkB+h+GfuWjOWtOBa5J7ElojPn5SA gzoM/3ecrpN5EfTg2XgmC3jnm5Q4P5SHMxi7aIy5do7ck/KFodQ8SmZHWwTanIDw 38xg1axR/4Es9YPyfuD/qAvP4xUP/163wdbE/UiVBGRByFGS+EJUIdfoQQYdnVoQ ndM48ilz43h2uElXYJwTKyXH2NV3dIGfjJ+TUl8HhiwAmZTbNRgP6oHoeRs3dO4F E//G8qrdKeZdaIINT7lOXYa0pHawes8lFSwNM0MMosDLU+4W6ns4GFjFD0ZTVud5 8e1CLCWYcS5tXRKV3CWU4y435eTQ1+VyVUQ5u6l7aob33DCUZlchCkZNGFCeV6IK PBPjOI3iZSeKBdw1erMHxZPUFa4M4A5/l+PvwFDD7/gn5VCIUU7/PeOy5dc6YIgZ tRbfdihFaLWqT3sF/JF0PTAtfdjpw5FsfVCC6ZItv2G5cg90W8alOAIZrMpt1hbP VeWcPnmhLaDnl7VOMMWgqqw/Q8r/azlJtvZQfJO1Akr8GNv6VwKvXbnOKUiPGAlw nLIaUS7x9a7Yj7KYK8REAN8aV7+pA6YrmcWvaLLo77i8q3cijOfPUoL1TLojbABR dYEKLQ7EhVSPILJ5MdH2o0Eam45iXcIYfRAQL2QCR6DbzEgGmsLCAtyLCBvTIZ4N MMJnKWzbsG7xxLalK/Ul7YPhQBUtATPYNNnWjzN7TR/+GIKWbq5u6a1Nre2wD7Zc jBkTeHWIJBHECFsmyHK35WoDv6zOIlx100k2/NeNSsXhsqylQiQtECN49GeSre57 t3YRJp44P6HVVjz1BZOl9AYbo0RDDFFbEDO/x81y0hmp4dJoUiAKXTMao735rnMS zlvc2jxvmDZAP/Mtdqy9yeeGkXR/oKU8x4cZlRkF+u6mHt6XSjgkqOPCk8qBr0OQ YQluXpIBFafwi0xHFxwjvrJ55TLchL50sPrlvh4WZjyun0mAQIMVssbO8ZGVV7Nr DosrMwsHrvW7RBx3WP0nU/5NbQsxSW7BwdMpkd0oC7fT47pD7akOyxhNlE3K/G7q hCmt3DMFE30ta2K8k4lmu2ZonOZFBDpMsfBcJnfzOzihoUKzWSuxScn8cAFcUgGX +ASmAkPhIXvm5gae08EGJuH+iR3fuHJJzwcGAj5uCSkbQFIbvgP3gSjzlX8ndlBA 5268QHCZvMbirTtVQqkxnYafQzyldhcx8uXH+yMyRCOCp3mgnP1PY8B3oug685Uc KPO2QoGF39YOfXfZWEYyRPnUYuc= Extension name: mr3d7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E50508EB35E0A248

http://decryptor.cc/E50508EB35E0A248

Extracted

Path

C:\nnc2g0o-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion nnc2g0o. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C1E842B4BAA81A9B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C1E842B4BAA81A9B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: CQC2SiXrTxYYiZPYpmnLE9uCA4k4ApIjG4AvzCc1mxiQAi6JggCpuOt0aSeMxFym 78WGtMTv/d86zF138KDveF9ji0+p41jtbtpVd34obIUyoOt8M5uJZc/hxW5tBBZ8 HkN5oil3ajtugcLYd1C3/8X5MZmdgyerlfMZUoOHKpPG8PiS0++apqrkSEx6YUFg 0NUvQscqfJTfzODosFhSPm6j+ViQVazi4iq27yVVx50k/fIaczqj8T5d8t9X979g CAcrBfwmi4ioLpITHLeToXsF9zBgTGt+me8KrlmAvJx6e2VQV/k6W/LCFT1ElPzr D/6jtmUI4SY3nCa6q20ODIXyaCftONAE2pSS95NICHG5rT7jbvjfm0jI27qIEx+4 G1k955KHKUZGZbLApJky//10M1/bX1mzDii8gRHnUhCuiEJ+BKpcMYW34Z6ekOQm t2LPy2COll9v6/N9am6VaWIPKVHJtFoXMgq8NctkVZQ0QkxiIDWbRaSda7d8pqsa beYKc/h7NDTCildq91oymXnqZ1NOhJCU7lxcyhGZ1QdAHJDMbs7cFokxb/4Z428X 1ENAlAL4ado1JCb9tvWAJ1Jw4TvfXgHyOeR/ijCznEz7yYbqcBUisEZr7z4xVfBu 6KJ0pw9ACfFlXnaP5oXwIRVNQtHvr13Jo826uQEtqjCp8hTqivmyCB8MNzkHEV6u /LTf58x9r1dL33OYlf9chomQToMTICbJC4OQ5LI7vDpEGZ9y8qJXLvRbGj5ODoT4 MV36n8/RzouM0UcVBkITy3CNkMdqdSZUkdIObkirBsc8+i71+F4KV+SPVFxwBAp+ 4TW8ebecbUukCx0x4f6NjMnSecBK1+DRelxN219B9mfASwJnzF94l7Visgh5EtSQ JoUhLqmxDN1NpuhvH+dDaPluhgNB3e3mCj/FGkDkcCx1VWqMXKtSHL1EovxbAeaA QRaNs2elUYtaNex1HDzf3enPQd/bBWj95vwZ9Frr/Gd4MK/fbAVRZmolYYKslXAI TNZmJDBhN7KRMDCjzGYnlV4uqSRInd5WrwWYYOjApUw/KPDgVnXhLtJK5537jXDY bR93dSqUrO4sg/IzV7ESvXrBE/CWMw8fdFknmaBj4UsOat8ICdTdz62UdP+fZLvu AUl91Kzvxn0cccqYHusE6EeUsqWDDpSBJ6NJNxow7DoFfvOt6PD9tdRHslOmbOw7 nqsq03FXvvDBueWz8fm1294dt7LQ5BHa54mRSOilVGtN2D2vryHBWmn3CeDobO43 2s8X7stX/sS+R4bTOd/gOcT0kpH8GMalYLzHs6kd Extension name: nnc2g0o ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C1E842B4BAA81A9B

http://decryptor.cc/C1E842B4BAA81A9B

Targets

    • Target

      dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c

    • Size

      116KB

    • MD5

      6cd56946aa6245d1eac3a88d4470a40c

    • SHA1

      b4635b3f442e3541a92f026fbb108abeb5d67df7

    • SHA256

      dc92f1c232d4df9cda71db227085e26424920c981c9be4d905d9bc89a504709c

    • SHA512

      4dffd58030258616b5123246d88abc4f2444aa0cc2809cb3cdcc81e01beaaa1ea784c5e7b969c1982ecd938041e658300c24a67049fe868f4b172a55311dbd8c

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks