General

  • Target

    937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e

  • Size

    118KB

  • Sample

    220306-ewyxzsaaa3

  • MD5

    0237b989a2baee892313244ad6376153

  • SHA1

    8677b1fa138f908fc791426f681995a1ca462ba9

  • SHA256

    937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e

  • SHA512

    88ea1dfb64da80834619c4039431cd1051fb00a9f081ff4697b05636f9e7aab83d6351a20437e26c40d7bfb3dc281e5cf55c3fb6b599410902c3c96aca9b2609

Malware Config

Extracted

Path

C:\7i376-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7i376. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Dear Bil Aurelis, President of CLEVELAND CRANE & SHOVEL SALES INC, besides the fact that we encrypted your files, we also downloaded 400 GB of the most important data from your servers. sql db, customers, taxes. As proof, write to us in the chat. Be sure all your files are safe and will not be leaked if payment is made. There is a serious flaw in your security system that makes you a vulnerable target for many who want to compromise your system and gain access to all of your computers. Our team specializes very well in the field of computer security and can help you cover this vulnerabilities and help restore all your files to their original state. You must understand, we do not want to do you bad and leave you with a vulnerable system. Our goal is to help you maintain the privacy of your clients and prevent your files from being leaked. And now let's imagine what losses your company will suffer if a huge part of confidential information on customers and partners is in the hands of people who know the value of this information. Given the experience of previous years, even the giants of the financial markets suffered from huge losses with such leaks. They hardly try to restore company's reputation, which of course entailed a bunch of associated problems. I would like to dwell on a small list of problems that you can avoid: 1. Reputation losses 2. Financial damage 3. Lawsuits from customers and partners for the leak of confidential information entailing enormous problems for them. 4. The involvement of federal services for a full check of the company and its financial audit. 5. The actual stagnation of the development of the company and the ability of competitors to take your market share. We think that your risk department can perfectly continue this list without us, but now back to your proposal. Actually, it only says one thing; your security system is not able to protect information and assess the extent of what happened in reality. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0273E1CADF203DED 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0273E1CADF203DED Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: 0w7uE4JH8Xkfv4HE93COdZY9QbZ4OQ7ptHo2a6F52s9Vh+2zA6zD4zonpKV2zq+S 5LPqxLUXC9XXW5uX+vnK9RZPT4v37i8ytkr9zOC0ZwfDUb/IOU/B8W6axgQLP/PY /nZ7+Xv+wqwX/8DVBkSqgm1MzbtPencZq1w8Q37bTmukakD0fKT2B+LygWf5MYsi wZniiPa7w+SCVEyCBrfNdi8zaR5zKTcf8PZoXk9Z0pSNrSPZb2zNK+GT+Ms37aje oIt7pH+qnnZcu9U5QxC8hLJS/QSoYAv7VxX7qydhtTnApdq8d0FUi9wG7am540NB vejE2/nz72HVIlIzyrP9PoAoQB/vEJ0GALiVrzYWdOgsVPv3xrpYSQc6rXjnkZSd Xeq7BWW6L3EWa7B2Hdn38vN2KDrRGsIysjGIlIUI9YP06N/wpWNwcyJXZ6mmX6hW 83EpM3xl1iL2mB/x7EbX/XDm5hZkb5wBLGtcvvpasIt32Lc7xxLsZlbjGYn4YApF Tow3PgyOzurafKKuFZsIBhUN9UQMaTDXcGmy9CnRNWPjQcu4ZleJPiVngT9a6ZAf A7FHFFEsMj3xou46MrVncYwQcmYjpj4t6YCrYAguc7V65NxEiKz80K30zrx5PYHt DCn4xC1o6RKXXZOoHtpTU5ypnvGQbJOReCjXlmmwlVaV3fcMRknL4MjaH7NIhCNo cEz30wLdgesSyO13SSBbNfB6h0Okwk/A/44WpgV47Z5jO0FAeth9ujv/rvxgVZ2w YdM81gcZO+rojenmOzbXdpV8TEEA87AnaWJNHH6SOXhJ9i8nfZL0jkCacJ3cEssy kttchDmIrvgfq9MBqltBDMNvMEqau4D+36llDWdEytrt5OS/K29VqnthWmxt6BQE oIIcgZwizQGmCyjhZgnJMr1tSYyojVi7OuJw3/tqRJQJYWEWxlN0wnPTyQ1OdU2/ Zf8F/BWJLaKhSfJtuymbzeF2zVsKjtftkEhMxF86ndDUhPsKJIk2/f9WdFg1OuHY nd9vjlLdygXp1oG+1WPD2jcl+R2X5QIdwHXHUgNSTBaXP8YD3zkiY6zjhpIEhZCL 57bqelWsSVd3bNlVrioVwuEbI4vvFXHoeFJNMpwhRi05oBN0cghyxaIUrNF12Bix N326iPZWDhGtl4QtU2rGKqPeYGWSiV81qnKKt+BbQoOLHSHgzBBgG4sW+4lAhtcR D7KLeaT8GKrWQ3x6WSt/jaS7mOy1rJUdaTLdWuaqGlo7v1itw0/24RpghmcwcyCR Ygn7fHIoFygyVN2zz5hn0vs7yJOJvg== Extension name: 7i376 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0273E1CADF203DED

http://decryptor.cc/0273E1CADF203DED

https://filehippo.com/download_tor_browser_for_windows/

Extracted

Path

C:\7a11y7l81h-readme.txt

Family

ryuk

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 7a11y7l81h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Dear Bil Aurelis, President of CLEVELAND CRANE & SHOVEL SALES INC, besides the fact that we encrypted your files, we also downloaded 400 GB of the most important data from your servers. sql db, customers, taxes. As proof, write to us in the chat. Be sure all your files are safe and will not be leaked if payment is made. There is a serious flaw in your security system that makes you a vulnerable target for many who want to compromise your system and gain access to all of your computers. Our team specializes very well in the field of computer security and can help you cover this vulnerabilities and help restore all your files to their original state. You must understand, we do not want to do you bad and leave you with a vulnerable system. Our goal is to help you maintain the privacy of your clients and prevent your files from being leaked. And now let's imagine what losses your company will suffer if a huge part of confidential information on customers and partners is in the hands of people who know the value of this information. Given the experience of previous years, even the giants of the financial markets suffered from huge losses with such leaks. They hardly try to restore company's reputation, which of course entailed a bunch of associated problems. I would like to dwell on a small list of problems that you can avoid: 1. Reputation losses 2. Financial damage 3. Lawsuits from customers and partners for the leak of confidential information entailing enormous problems for them. 4. The involvement of federal services for a full check of the company and its financial audit. 5. The actual stagnation of the development of the company and the ability of competitors to take your market share. We think that your risk department can perfectly continue this list without us, but now back to your proposal. Actually, it only says one thing; your security system is not able to protect information and assess the extent of what happened in reality. You can see our work methods in our blog. If a company don't pay, we public data or sell it in auction: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion All companies that do not pay the ransom sooner or later end up on the list whose files are sold at auction, or are directly merged in the public. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/80E17E73775A3CB8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/80E17E73775A3CB8 Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: kiu7/nIV7RtTcXsLJfJQCxSBk4ThHMfOgolPsRTR58StqM5izi+eDvUZhRgVsI/X HXtGxNqMFkIfhGBDmUkyQJrU1mGRO08Re3jJsMfFuY/HX5ua6S2SOuK1qx1a41cy LIZC2CCb8etKbr2HSN6cjCokv+t6CziBVE93x3p7qPXx6NeSy8nL2sDq7G7ml6gA Fr01NT0x9XcyRM6/Ah23Q8s4KvGtJdhDtbB+aAeShUZtB97OFzCg0+HSQbroBBT2 G447sBtq5SSgyWNkh59f/NzG838pdwhR/Jk/x4P63ToofEW9TCpJAGyEWiv+kUKY pF668+lV6TXvYApLCtkcnFIIrZkPIruyP0g7bB6mO242K/P4/739heWhZ5VrSu+B H2K/AYdssoZsGEZeX084Xqm29/DtsdD9RcTHnsFSvybFjRN9+BysTfJoATH0+aZ9 sxhpU9/Vfc9dXcHlTpCtc260/9xq8tAMPuKufSsDpVL7lT+bYSDMfYLxm9oniIyJ g3OQcuyn5jwQagOkqCGEJ3LMJ2k3w3M2rEbtdhHskcorusE5nKMNHEU4W1jVHBvR a3VzsTx/jF1g3CaPDPiIj3CZM5XcfCL86lD11SAcodCQ/ivu5R31SWlhixR6/3G0 C7wT25kIKM4LFm+uMw6hZ1qgkdVtmC0FM0s68T5Fk0kNvruztGw1jBURiIruMKX+ fZbs4Up9XBp2LovV9LgHuDLKizLBebsN+EGPaYPwAY9/3BDt8kuWSSG7HAwapmS3 AnRyRpOoHNNbRSBCoPbvTwas1XylN53nfpD4aWPwmra1SdKJxn4mqwP24sY5/d+/ BQ/n9ao1PjPvujpEQmjU7VoRkrfLawKIat+oYI7P5dSM1vpqeYqYFOesookgCnyi 3wzTCAUAB2NrVZTnGM23t1XFXzM4euHt4dJMJmNVlNqBkm3pRDYKMIAEJjdqvNef hLM6GYzlJ/oQsQ9AuVyZeBqmdG+ntT2gph4TFjJwqweqGNveVUobAqdDEC62wvNV 4EjSMSnBmeAVjQk+4ysgSuds97mEXZ5079f8j3wV1WAop+zfXJJ0nInt8U4GwicN frlmsyurnoUzKObvgVF5ScirEl7Esl7J3ia4zHeWbh7EOPNpPHTgueb+glm7HR+k qZAS64Au0j1yRSIOq4ahtyoZSAflM1u0C6kp45cWpjJPC6nsbElx5HzbR3Z2RhMX 0ZQUMvM5BYCcKbHLwfHT8fv8YfliVYrVu4kz0ZfVgQCgJin3y7uJ5Fpjrz8HINeP nA7XH20lgfn+VXq3V+CX8EcYtLNxZxAXoK10aD9UUuIqwySkpRk= Extension name: 7a11y7l81h ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/80E17E73775A3CB8

http://decryptor.cc/80E17E73775A3CB8

https://filehippo.com/download_tor_browser_for_windows/

Targets

    • Target

      937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e

    • Size

      118KB

    • MD5

      0237b989a2baee892313244ad6376153

    • SHA1

      8677b1fa138f908fc791426f681995a1ca462ba9

    • SHA256

      937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e

    • SHA512

      88ea1dfb64da80834619c4039431cd1051fb00a9f081ff4697b05636f9e7aab83d6351a20437e26c40d7bfb3dc281e5cf55c3fb6b599410902c3c96aca9b2609

    • Ryuk

      Ransomware distributed via existing botnets, often Trickbot or Emotet.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks