General

  • Target

    686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7

  • Size

    146KB

  • Sample

    220415-lms4psahd4

  • MD5

    00361d8aa092628e2339239537bdbe2c

  • SHA1

    aaf3890dce9eb8c75c09cfc60eb5f796b408d026

  • SHA256

    686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7

  • SHA512

    64db40b3fa7d1552166ef665d0d5f6f2a13f0c8c50ef8cd7fa6ce7656b049f8e077a2ec54b02b36c2331e3b8768a1a7b05cc7f51ce5f19aaa4ae3edd80f64dfb

Malware Config

Extracted

Path

C:\8611oyc8m-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8611oyc8m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EB293A08D0353D6F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/EB293A08D0353D6F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: U5hhSiqzCsqgLgD8T2hzlUPs3/Wld9uS1b9hrBkwyXxG0wj172q+52Fy5LlXuY8t RgorY+eei0gnnb8ZYvzQ5F5hw5Rhfe87HvmVDbhye7SSZMlw29DxQV153hOwqVdh t7m9hCFIHoxbM2pBZqtMGBkMy3Vu4n1AW0nKD0W9rYtWQKyD82UpIgMdUh2XWfzo +kiQL1X8VrqZBaHF2ai+YIulLiHOyiUcAUiQC69HEpO4vrY4E87vmh9C1IXdUexw L/T5UCfpLOja/LWb8ENGzqtskt9sat35Pfszx+Qlh+Wvy/dyfjLFWsvrQnVEIs6x erEF7dCQIgjB0Ndh1hjM4jLoZq72F4PiKNMp8giM8nJwm0f8zVmt4sXSofQbY91H yPFh97fXUR9tqyy1QiGggCtX8GqFKi+z/4TJTKheNX9zTeewUvAS7Dn6/Z/E+zx3 l4QIBHeuAFNa+Q8uMpe5Umr7f5ty2HPVUNttAr4AGyAbhf/EU+L8Lqg3J2ynb3e2 +zZD0Gup1Dz2fkNSPudcRjLni1x0SyXRWWDMm+sUP1bH5dlC1vB0zxoVvCQ92UGx BrO34rmiwrI13DK1sWGwNU9qNBMPU9mX5DslzmeByWWjPf36DdNPRKtkWqnoiiPl 7qhdPDSKlaDaj2M/Z+vX+cAQUOwoBFX2Z4ngFFLwm6r+QyJ7XEydyHqkFGK6oYLm hig7pHK9lQ5KgoxP8m7j0wLr1XNnUqI4VFXK09zvwOkMJQJaYh4lgdRVt79JUhap NvTyanymd5ON8YHt5K+S2B/W4f08pnM3kgyICDDqGxMHQ5H0VY9w+Nfda8rVy1V9 hOMlMxKI44TVR3O0XkPHO2Lj/SxFLOcjS6C2wQh1JEjBiY571w47RMZ9NBBiw/PB mhMVSqPGX6uTtK8xSPNgozSAGe5SLM9LuHuWtfPgaVa8zXBND3Y/3CjsOMfMdago mAbvjw6u+X6RQRyxhMM/2fVyYtUZOmi7d84vX8TB+7gWYRx6UIlM+Rub+5qJt8uA QGyW62d5PYeOG7sjWc32o3HqkOAP/MirAlQ/ehsOKYafjCg+Q9j6bcfWnFyIH6nW d8D8O/d+NBlBV8ZFCQRfxJM3PYWXg4PDDwhWOjOYZH5iQZ4k779QuQOpR/oAxSPy Jt8uOba2B4AXQXJstbksjml66FYtcaPOwVPkFoE9f8J0pzZ5OdJVpmWB3ThhPv93 batwR3SEzzBFvIIS8wtP4kVzgsX1H6gKBpmpEdceEZS/LRq2Wvzo8UGtG0+InWbZ VBIEaTbM7uaDWuBq4C4MbNSjXRgqtyYVJxpQG6ItQ/KFpTtN ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EB293A08D0353D6F

http://decryptor.cc/EB293A08D0353D6F

Extracted

Family

sodinokibi

Botnet

$2a$10$Wlb.6omIqlVeirP4q3KysOlMVQGNS7LVUvZJsVFcPGaAiZ15vw/4.

Campaign

5856

C2

1team.es

theclubms.com

kaotikkustomz.com

havecamerawilltravel2017.wordpress.com

rerekatu.com

triactis.com

mbxvii.com

aselbermachen.com

solhaug.tk

ikads.org

lebellevue.fr

blewback.com

joyeriaorindia.com

bastutunnan.se

xoabigail.com

lescomtesdemean.be

conexa4papers.trade

basisschooldezonnewijzer.nl

destinationclients.fr

connectedace.com

Attributes
  • net

    true

  • pid

    $2a$10$Wlb.6omIqlVeirP4q3KysOlMVQGNS7LVUvZJsVFcPGaAiZ15vw/4.

  • prc

    thebat

    excel

    visio

    dbsnmp

    encsvc

    oracle

    agntsvc

    mspub

    thunderbird

    tbirdconfig

    dbeng50

    ocautoupds

    mydesktopservice

    isqlplussvc

    wordpad

    synctime

    steam

    mydesktopqos

    ocomm

    outlook

    firefox

    winword

    powerpnt

    sqbcoreservice

    ocssd

    sql

    msaccess

    xfssvccon

    onenote

    infopath

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5856

  • svc

    sql

    mepocs

    veeam

    memtas

    vss

    backup

    svc$

    sophos

Targets

    • Target

      686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7

    • Size

      146KB

    • MD5

      00361d8aa092628e2339239537bdbe2c

    • SHA1

      aaf3890dce9eb8c75c09cfc60eb5f796b408d026

    • SHA256

      686deabe720e279246b10480b13bc68b494587eeeecd9ee5032e82a24e166bd7

    • SHA512

      64db40b3fa7d1552166ef665d0d5f6f2a13f0c8c50ef8cd7fa6ce7656b049f8e077a2ec54b02b36c2331e3b8768a1a7b05cc7f51ce5f19aaa4ae3edd80f64dfb

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks