General

  • Target

    bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815

  • Size

    680KB

  • Sample

    220305-xcwbvsghh8

  • MD5

    d8c45725b2b0654be969ea1366e1994e

  • SHA1

    38feb428aa76ce397b33865cfd26a39bdbe3166c

  • SHA256

    bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815

  • SHA512

    3975f885b650830c9300ba05c38f45869172d88bf8e20a270a9543dc30c75ef8c329f61c99caab8e1688df7f520fe7cdb06804586ba497ca9e73b7536e8fe8f1

Malware Config

Extracted

Path

C:\Recovery\12m121-HOW-TO-DECRYPT.txt

Ransom Note
--=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 12m121. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E446A02EB004011 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7E446A02EB004011 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XZbZjeawO+Hm3j1ZPkveasTph37JSC4sMnxAXxF5clMQ+7EF6GMJBw3ZGL7AB8eF Q2VeOy7n3v4XLCDELnU21/kOva0RyXFYgNNlYxgPe4z7TQ3R+2qvW661cY1NfNeC wmLqa0GKpS/JNSGXVfDhXE5gqvb0o894KGKmstce9Ual99kpi0OKU4Hdn25JAung vFMGUfLdwQuz54TNHsKRFAaYhgVdJZ77syLFXNUKJdjQMxnhRYKL2EN0oL267P4t 63BlD3Bmoq81XhuV2lgK6veeQt6Kp1M/l6RVvVP4kWWtpN4XTdXz9OONkR3OkDnn 2/BH3W/FhuyBeR3lpPARCUMUx98t3W9z/OSi687PZRJzNTaYv4o6qft+YhKq9kkT w1ytJyNWhpc1MR7AexA0HfObXTpyjRf2VN27InSz+vEMZb3AmJJXNFtRYhjgOppg mlJBsqQUqrZjJQMhWXYcokeqRSstgRyCET8ApsUfPKIBDR9Oswckc0WBs+TRhfSv LhuxA38umVpDHY0i8ssesvJSyllV2HhniEetkNQ9bcQ8YT3kMBDoAzJvLmrPWGRv T6GMEompGMtLrITdyt4uxQJaQVrmnXdoJ1Gamq+qwVXFA2bZzwQr9X1YzNhMkLXZ TbzCUe8bKcpwCx3/b6qB78ghKEQ+HQamiRWnJnIvu8dkG9EAhpXCUSRMkR2fk/pq YREQ6mLVZkOPKAT8eQlxGH5mpKFS9SE6cwCumXQQjt7cDb66uUzBC4clCR1db78h nMFRvn2ke4j3ofaZHRyMxec2AJnqWR0Xp7nMwExk2zCwgaBBo4Rmog6sN+4wCQ4n 81/hprdXu1ltc+9vVIQ6uagxhVGdL52rK9WmYodvwYNmd8vTlnvwSJ4vKpxRaX92 yk4i6P2IFOagAZKt2rMJy8jh0aRd8pM0RyHR8kZOl9p7X9MXjdkA9s70tWpEJB/n NpBRSO5OeG4WWy1g7kRl3cSpB90e2VNwCUZwl0dkip09dG5uCbCD1SxHQT57F1SR 79UsvFGvdGywuOnOPqknWjTElEf43+weUzguW/ugmuRkrc7E+jw0oyAI3dPP8yVv Fe6HZ9ERbJ6I0UiTPdM= Extension name: 12m121 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7E446A02EB004011

http://decryptor.top/7E446A02EB004011

Extracted

Family

sodinokibi

Botnet

7

Campaign

3

C2

cymru.futbol

altocontatto.net

rvside.com

noda.com.ua

christianscholz.de

wallflowersandrakes.com

tanatek.com

pinthelook.com

tastevirginia.com

campinglaforetdetesse.com

poems-for-the-soul.ch

k-zubki.ru

selected-minds.de

smarttourism.academy

the5thquestion.com

sochi-okna23.ru

osn.ro

suitesartemis.gr

efficiencyconsulting.es

kickittickets.com

Attributes
  • net

    true

  • pid

    7

  • prc

    mysql.exe

  • ransom_oneliner

    You are infected! Read {EXT}-HOW-TO-DECRYPT.txt!

  • ransom_template

    --=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3

Extracted

Path

C:\odt\u92765k2h-HOW-TO-DECRYPT.txt

Ransom Note
--=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion u92765k2h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/32990CD05EE208D9 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/32990CD05EE208D9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: J/ii49jv1WFoOwWbpHoG600NVesuyYPFiWuARbWy2Zo8yTBGUul3PCL+7Uue72Tu KDU7NBNKFiydzXU/m4XpQ5PLPSAOgXyk3yR0HTF1EoGVzl/G0IbhyV7oKxJ9GofL jA6Fs9AL5RHPS//0TdDFFzQN9VjsiI++98KdiBjYQfYJLlvmSIousCd34y95qn/l H+x4R7w7V2DU18MyL5OWIzUpVqFVaGGdXNop9C2E8sRdx4ciAQS/B9L1klZxFXn/ goz7hbqIA/wiyzGNWiKywGQiPld8tB8OCFFLFB5v1dqQ1cVODv6kqFNnhd3/sqh7 syJGCY1lJZSduK9vzTisDDf/fMn500b+Fpu6nCORQy1EWS0Gr8EVB07ENSrLIFwu fmiPngY4xHIGRCUDcrOE7JyjSkYaEj2gFzqJi26Vu9WSMyZVj05vHrv5maby2z6Z IDD/PSdoSY1KPFtM7rHQ+mEqzVyVaiZ8Sf0AtZ9OMZxWnLpPkwtX4TQQCY3HyZwu Wy/++B+94mQq3lLUTJFPYN0Yc7h0arwfCdKX+/sVV+NDQ+tR/VCDehuY4PvvTshu pxkUOonR5hs0KWJuhdCbPwWGiMdGZMkT9gSuOC/6bLoZjA8NxdZO6hAHqC2qHlv6 3v3P77OeHjkfXzrX3quOM8ydSAnMqUImQ+RKVNVXIQ3cJVV3/+W4kw4A6uYfIx5/ m9mtaTtFcWUO8RHHl+EdMIYeCJuFQW+dnziWDk+N/nNAMU9erLbpkDxTeTeBOcUJ BMU69gJvQRGEckXtx1uGB2Jf/eeabI+R35XvQLDzUdvusJKPbjxAZkNebxqKK/G0 qrizEVxK8gQRrA85DRev485K7CvaOJy2mpzzEgHg4LnQAhpABdFJvDx0t9W95Ijj J+NOvRiKxaGc4ZZhCEjotqIFgwJg/4sO296sbGSNcmgn34Vi4eK1XfTxPREUC2RI qKTJexUj21qfHTBr/J3PnfxMjpaXGSxs4TvLKi0eV2OUL16yLF8g+hTHg68arCF/ /9Dljvt6C4/DVidAW0V+9BOSt8UabpKt64QLefuOtJkxLthsWLHcAUva+lsCIQM4 SIVckgPbBA4ebpexv72OiRK+gYA= Extension name: u92765k2h ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/32990CD05EE208D9

http://decryptor.top/32990CD05EE208D9

Targets

    • Target

      bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815

    • Size

      680KB

    • MD5

      d8c45725b2b0654be969ea1366e1994e

    • SHA1

      38feb428aa76ce397b33865cfd26a39bdbe3166c

    • SHA256

      bcdb6f903d091cb844238510062f17f9c16d96959b1e2bf511de0e869ebbc815

    • SHA512

      3975f885b650830c9300ba05c38f45869172d88bf8e20a270a9543dc30c75ef8c329f61c99caab8e1688df7f520fe7cdb06804586ba497ca9e73b7536e8fe8f1

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks