General

  • Target

    09311624f0f12ab167bf4f500fde8c61322e3539d6d92d4a129d74988c54795f

  • Size

    164KB

  • Sample

    220530-x22j6sgea8

  • MD5

    279307531184c2ffe01896ce0aaf697a

  • SHA1

    8a8bac253d924748545f914ef6486cf6ec95cf2d

  • SHA256

    09311624f0f12ab167bf4f500fde8c61322e3539d6d92d4a129d74988c54795f

  • SHA512

    7b05bebc228b951132925839ccf0b17aeaca23a51c96770269ff9d33152519776cb9989504fc8755d6d8f7b4a62328eb811c00cc9b4d70288efe4212e018fe1c

Malware Config

Extracted

Family

sodinokibi

Botnet

13

Campaign

979

C2

kryptos72.com

riffenmattgarage.ch

eos-horlogerie.com

valiant-voice.com

circuit-diagramz.com

jandhpest.com

alnectus.com

housesofwa.com

animation-pro.co.uk

pilotgreen.com

onlinetvgroup.com

limmortelyouth.com

almamidwifery.com

ufovidmag.com

patriotcleaning.net

testitjavertailut.net

aslog.fr

photonag.com

imagine-entertainment.com

fotoeditores.com

Attributes
  • net

    true

  • pid

    13

  • prc

    firefox

    visio

    mydesktopqos

    outlook

    agntsvc

    ocomm

    dbsnmp

    steam

    encsvc

    sqbcoreservice

    tbirdconfig

    synctime

    wordpa

    thunderbird

    onenote

    mspub

    oracle

    mydesktopservice

    excel

    dbeng50

    thebat

    infopath

    isqlplussvc

    xfssvccon

    msaccess

    powerpnt

    ocssd

    sql

    winword

    ocautoupds

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    979

  • svc

    sophos

    sql

    memtas

    veeam

    svc$

    mepocs

    backup

    vss

Extracted

Path

C:\6a54pst-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 6a54pst. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D3611758587231F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/5D3611758587231F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LXAIP02jRaOmYYIbO8XF0TfY8+lQXmwHKDFLiEtx8EifRH6p5Oh16+VSk84AuPMz Zi88elSoLma0TJt+bIss7uTIvdrS9vnMBezbNUiT+qtXiDZVnfJ7rGK6dsyiy4be nQXC80ZWUnf4A9WVG7OZwEJvgDDrhRy2JXOMPhQsaZ/OG8rVdHCycdHYqEJWKQq9 wpH7vbqDjVMDMiC45xBIe0JINr8bmiZoIndlFj2e8qHgbKkt9pappvJWK+RSl50m zLSjeb/dT9F9hVXi64EI05l9oe4gy51Fl7yE4WDlG5Av+vFTkQQDnz7Jy0ObxcIq FH/gHQUy7FAne/QrFW2pljzbsXJ1/qiGMXudCvY6AKPo0bKeec9L6H5DnuZzqaoj o1ELkN2BnsZlY+qBQazCjHWyjWoOV1ni2v6+yJaH1RRaOcHnsHnehuSG3KJvipJC pyysXeIq5CxpLDDTfkLKLOUnUE6GxqnxUHzATW1SsZDEXdVfmp0NEhlLnCGBhVas 7j3Tbh5DH62r7RcSk971NhChiWVOU5Gxq7Gbuaq+BhtZPOimSZURv1zAaPc25nok vICm0YJ3R4zgcMZr2MCeNB323ZYkxC7hTaJcu9wja/3+IjP1w8KRcXIt9ZkeNGxx dz2pkIGprMBznMPvwENXeDXQeF1gVSzN4fK5lwzbQwXbp3ujPLnt2AOoFEZksrF2 N0enDQcEogoipswFjqYuaJ/brGZu8gCfsMJHFano6SVc1jmzyy8pPWFlFJ+IdR6j EIB2G1mbLD5mx7TZirowMdYmSkuOhqBZvZvXoFS+PTgWHsDTql11sr2J1Xwd6aSR b2Aw7DhkPrqguerRjsTUHK81DW2uwTTH6Pjk/tMWfcjbHexVCZ7iZ7whRZIbHIJS zhIgWQabwUgtze4VJeXfjZW8Lvj+1GoQ2hrP8F5BtBUvV0BNMsXWqLZP0zL9ppS8 yBGzhDqsW3hnsdEn24JZdahJHv5I8inS531eMsfkIh/PV9QA4vBx/H8zZOwuK2/c q7klAHrgAG+FY8G3nOCFFbWmypWCisMqqVYP+gu0h7LAxFqNfn32b4ic4AMgxRh+ WAZZFPJGfkJkMIvP2MtPdo97qYo+le/tS21ufqQ0gxtaZwVB72rESsrZQWvS3b6f XtiGwXWlHunyrw== Extension name: 6a54pst ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D3611758587231F

http://decryptor.top/5D3611758587231F

Targets

    • Target

      09311624f0f12ab167bf4f500fde8c61322e3539d6d92d4a129d74988c54795f

    • Size

      164KB

    • MD5

      279307531184c2ffe01896ce0aaf697a

    • SHA1

      8a8bac253d924748545f914ef6486cf6ec95cf2d

    • SHA256

      09311624f0f12ab167bf4f500fde8c61322e3539d6d92d4a129d74988c54795f

    • SHA512

      7b05bebc228b951132925839ccf0b17aeaca23a51c96770269ff9d33152519776cb9989504fc8755d6d8f7b4a62328eb811c00cc9b4d70288efe4212e018fe1c

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks