General

  • Target

    1ea41b12d99ab5a17cb942ff246b0333f298a52cfbcdf412270109519db2054a

  • Size

    164KB

  • Sample

    220612-y8frqaeedm

  • MD5

    f684dd75717606501dd434a817ff0876

  • SHA1

    06b853e6e9d6cace3736cd37dbc43d9cdf1445d3

  • SHA256

    1ea41b12d99ab5a17cb942ff246b0333f298a52cfbcdf412270109519db2054a

  • SHA512

    038445162c66e0c6a88ff8c243af615fb301f6a6f29635ec00b7e8a876a621af8b288f0850a9830c43685bdcdb374b0f17b5694833c4ba06ad19e5a014b8216c

Malware Config

Extracted

Family

sodinokibi

Botnet

16

Campaign

1778

C2

indiebizadvocates.org

adabible.org

bourchier.org

charlesfrancis.photos

annida.it

wirmuessenreden.com

poems-for-the-soul.ch

richardmaybury.co.uk

salonlamar.nl

dogsunlimitedguide.com

koncept-m.ru

metcalfe.ca

signamedia.de

techybash.com

mahikuchen.com

bayshoreelite.com

hnkns.com

rhino-storage.co.uk

floweringsun.org

spartamovers.com

Attributes
  • net

    false

  • pid

    16

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1778

Extracted

Path

C:\y3i0r6dvo2-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension y3i0r6dvo2. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/274D7349B8D242AC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/274D7349B8D242AC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Da5nbcusa7mVDQj7Q8p/yuklSI50/9ba5+yJ3T0TypFAYsV1yhWSEvR16+KHnxTV mXMwHiadTW/OInP+wxhXKEW7c7DsILn0qrDJS7WdGpm0mkJ04wz4yPLi8FYeDMfT ljeoQJXC9p3fhRnyQwv1waazmXVjkFu1VZlM52fk//p2TFrU9rDuulE2ma+IRLeL XJCVQdlIkaRan2j5kdIi+Ujz+vm1uATUR/P4hcU1VcUHnUJ9LP/BLlsfigkNRkDd Ys46LXz6VQdCMW16PYt4mM5gNtMcBi87UoqVsyp/HGCT3Frc11o7+hQ/FXyk7UiE yGqJTvX2+auwgRG57Pg4j8YDdJ2bYcZ0j3Nm0VAos6gYvAW59IsOQyF5poDFGAJv E/CrAZ6qgeAJGswdJkdHekZwtP4KdHIopPXoaH+NqgRF9yrMmPkwOLOw8ltTUWD8 nopOFJ8SBeJQ17BsaxGy2954CBOBlfCtPG086/iwMMssjdtlhNGIuA9nybSB040A VHhDyNrnQU5vHNJcPfhS3u6GHv6DZdxcyfLbpwsy0zKS6E3wjc5z8vKPZfCnpuJi JeY5JkYiWeQc2s0P11LXEzk8qdXA+6xDUOD2d/wJpXLjKIise/SSNL7XXMjrOSnv AI7pJJfHg1Kh0BWZbQAhT5XuExEth+cKz8pqs+ez/cOjrgIyHQQ211fqFWklfbDc KgD8bU2LdiBX1FVJsu44s8ottO/GMEeV1eSUvDe4aU1d7Mu+Tljo166YTxE/CBm9 7AE8CfEmo8l+N2eZKeiy79hcqBMD7c7grbVo0rohja4kpHUujV8bdtJ99/aaeM4W PkN63UeyYDr2d4MDaQyIzMBEhgMMEEpDRIwUM3WL5Lc05jhos7xAblddpKdF/uHs wiaZMfaEwq1pUwgGdKJmNJaND2qVQt+rlSTGsgxUpLBklP3n1OToTKrrENj7T2oP 986PrNxDHzg0qkB1t364USSDvfvwB4Akx0FgbFMsDFkV+CCZr0P3DaCxS2jdXgxY GGsxv6C02+gl08vfbAYo79kvpDWOgqYppwIkgn6xKCa3FtAvUsWAjqf2tCpa1LP6 j5lDGJrCNTq91pmcx1k6WOMIYbDCeOVCFZTVF4ENn+9ai18jp6aiwAFXXYP+YEgX Bwazgb5GRhwPoVQp7kVIBnMH Extension name: y3i0r6dvo2 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/274D7349B8D242AC

http://decryptor.top/274D7349B8D242AC

Targets

    • Target

      1ea41b12d99ab5a17cb942ff246b0333f298a52cfbcdf412270109519db2054a

    • Size

      164KB

    • MD5

      f684dd75717606501dd434a817ff0876

    • SHA1

      06b853e6e9d6cace3736cd37dbc43d9cdf1445d3

    • SHA256

      1ea41b12d99ab5a17cb942ff246b0333f298a52cfbcdf412270109519db2054a

    • SHA512

      038445162c66e0c6a88ff8c243af615fb301f6a6f29635ec00b7e8a876a621af8b288f0850a9830c43685bdcdb374b0f17b5694833c4ba06ad19e5a014b8216c

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks