General

  • Target

    1bb894b7a8742c7ec6d28fbea08713f842aca4fe6d90a5a5d87c1b247da90f92

  • Size

    164KB

  • Sample

    220607-wdp1ssegc4

  • MD5

    af93df4d11d547ac7b4f829487eda638

  • SHA1

    573688ef2515b6bb2f07263e98b1fd143eb20c54

  • SHA256

    1bb894b7a8742c7ec6d28fbea08713f842aca4fe6d90a5a5d87c1b247da90f92

  • SHA512

    bd22ffd9251bac4fc39bf1c3e97bbf2350bae1a6bfc9efd626a1d798b48db4c56aa3e0ac2cdeab10eb62387da26bd0c221b1032e770515f01cf368fd93f3c1b4

Malware Config

Extracted

Family

sodinokibi

Botnet

30

Campaign

97

C2

hvitfeldt.dk

k-zubki.ru

ilveshistoria.com

9nar.com

fta-media.com

jakubrybak.com

alaskaremote.com

the-beauty-guides.com

lexced.com

nvisionsigns.com

saint-malo-developpement.fr

epicjapanart.com

mneti.ru

drnelsonpediatrics.com

julielusktherapy.com

katherinealy.com

advanced-removals.co.uk

acibademmobil.com.tr

adedesign.com

schluesseldienste-hannover.de

Attributes
  • net

    true

  • pid

    30

  • prc

    powerpnt

    mysqld_nt

    mydesktopservice

    tbirdconfig

    mydesktopqos

    onenote

    wordpad

    excel

    thunderbird

    outlook

    mspub

    agntsvc

    dbeng50

    mysqld

    visio

    mysqld_opt

    msftesql

    thebat

    sqlwriter

    xfssvccon

    ocomm

    winword

    msaccess

    dbsnmp

    sqlagent

    steam

    infopath

    sqbcoreservice

    ocautoupds

    thebat64

    ocssd

    sqlservr

    oracle

    encsvc

    synctime

    isqlplussvc

    sqlbrowser

    firefoxconfig

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    97

  • svc

    veeam

    sql

    backup

    mepocs

    vss

    memtas

    svc$

    sophos

Extracted

Path

C:\59o937942t-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 59o937942t. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EDA38C24453330A3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/EDA38C24453330A3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tSYDMsmo+chJAuGauQZtd07wbSAUQXeJnFWqo5VqI1mrDor4udVppt01C3V3uLPs OZrS9q6RjS+0z87txHnoO0nuLN7qW/HVCROyooXcJunR+gXsB/sl9R8OxAcAmmpy KHbscaZKr3PN6wQiwhbtZ5bYCzkGKhAgEZ47fgVaLcyVP9e9xKkxDDcqliOQx7FN kjsMgy7fh4tvUN0E+L5Dk4L8pM6TK6GaYrsDfb78QHa8urjjQKd7FOzZnAGormof t98uR6o+p3Z4Nf2Vp6PNsNQ8dAWk8o3uNb1x2T+HObMFg/FfY7aOgS49ZTxDVet1 tIcSaUYtgvTcqkMlYnmwGAbQT/u8u2w/R7jgadWPAEBLVFx23bV+fiMVd9z3ArtA UcAIoBx/WVOzLXkSGXsIz0WlwegZlN4f4Kw7yY4YBeG0Zsk0FDLNyCtzzgnxxjOO I7SbF7waap4wjmKtjpXe1KNx3ua+MFJgEur9sQ7wOemYm5NtSShjPugzUBhNpeSu 1q5WCIFI8W3Xcz0TMl9uaq12rZdli8dCkgmggAuw9lFaaYzyupOP4t+JyQGQfNO0 W6+zgssfQGE0tLkbkBFhbb389jqCCK5yZVGa+2k+37hRR9rBUEjIYBlDwrxAKNpO FtEKVIiOMHrR4adh6KCNMmb+sJASiCyhhAHAg4LwILxlqfZm7J9b29Jt/pBsDuQN kFua7o46fZISowG3cG2vF8OBMI/h6MvR0eNwr0GX064jmqiBGrJ/5uoK3HbitHsP HbU7iisr3BahLm5Qewt8uAxR/vZQSn3tgy2rGA+gaoI5pafs+xCwlUgRHeIoK51G RcBuJW0M5Q+y7Ao3ZoQ1mweubAK1Zqq6k5qOkNng/zt6HVo5N7en0grOMSgCXZOA ArQyy0s0Zcz7gdllhCj6FhgM0fJWsKou2Zyjs6+xCuvWqkz7F2gvBdPEZVeSSz+2 rjIOcOxKkoNIg0S3MGu+L+a5DLxWIAr5gEskuvXrdToii7EXVbk8Rifi/R2QA3R1 I0MP5k6AXFCOSOT6E0d00MF7IieU7dH9wYtiCusBt6qPDkS9W7h1soru1gxbIGo6 uyxR+gYT9/tK+IhjuEn9gsL6yo0+yyvemdUv7GmPn9Amx7Ck8DPDlUhvw+FdGu3t 4/aGHQXxdkR+ucsyhNc= Extension name: 59o937942t ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/EDA38C24453330A3

http://decryptor.top/EDA38C24453330A3

Targets

    • Target

      1bb894b7a8742c7ec6d28fbea08713f842aca4fe6d90a5a5d87c1b247da90f92

    • Size

      164KB

    • MD5

      af93df4d11d547ac7b4f829487eda638

    • SHA1

      573688ef2515b6bb2f07263e98b1fd143eb20c54

    • SHA256

      1bb894b7a8742c7ec6d28fbea08713f842aca4fe6d90a5a5d87c1b247da90f92

    • SHA512

      bd22ffd9251bac4fc39bf1c3e97bbf2350bae1a6bfc9efd626a1d798b48db4c56aa3e0ac2cdeab10eb62387da26bd0c221b1032e770515f01cf368fd93f3c1b4

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks