General

  • Target

    353fb7a00f04bf34de0f9b9cb590900503fe491eb00e236e8201160d709b9eb3

  • Size

    427KB

  • Sample

    220619-wypwjaafe5

  • MD5

    5bd321ec41ca42647d6fbd40f73f72d6

  • SHA1

    797d0ae3a36d31e858ab55466ec3095708ff4fb8

  • SHA256

    353fb7a00f04bf34de0f9b9cb590900503fe491eb00e236e8201160d709b9eb3

  • SHA512

    453360625675ab2d1eaf577025e5c03f27bbb64ab2132e1287dec43c0becb0af3292e0746e4158d912e2abf8c8b436b2aed155508275a000a303969ad2e8f8f0

Malware Config

Extracted

Family

sodinokibi

Botnet

21

Campaign

707

C2

framemyballs.com

eatyoveges.com

animalfood-online.de

geoweb.software

dentallabor-luenen.de

goodboyscustom.com

pedmanson.com

selected-minds.de

blavait.fr

nginx.com

iexpert99.com

bruut.online

lattalvor.com

legundschiess.de

transifer.fr

dieetuniversiteit.nl

nicksrock.com

sppdstats.com

ludoil.it

otpusk.zp.ua

Attributes
  • net

    true

  • pid

    21

  • prc

    onenote

    msaccess

    agntsvc

    encsvc

    thunderbird

    wordpa

    winword

    ocautoupds

    powerpnt

    sql

    oracle

    ocssd

    sqbcoreservice

    firefox

    mydesktopqos

    thebat

    ocomm

    tbirdconfig

    synctime

    mspub

    dbeng50

    visio

    mydesktopservice

    excel

    steam

    outlook

    xfssvccon

    dbsnmp

    isqlplussvc

    infopath

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    707

  • svc

    svc$

    sql

    memtas

    mepocs

    veeam

    backup

    sophos

    vss

Extracted

Path

C:\6d6yp6wrmo-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 6d6yp6wrmo. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0045E3CF95919D8B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/0045E3CF95919D8B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: G/WCStGluv9UCCv4f+corG9mUv/3XJC6Zs3KOolMQ9mzJ9qt1R4/pEcxgJDKm/qK QxUBv4rXpnhXBoFRD7qHUlgRZvUPrjBxU+CcPAOBEGnBzOwjXsYjPmdaUFYteSS8 f0fC4XbyCy1zEt+/CiJEGn+ObUj5SX1EG35qw/CLee4CFTQ6v0A2vCYdf13q2Kq3 6gv7I0dY7W8Oy95LADeb/iwrBtc0A7yKhCm6Ey7iJQ9w9nFb0EQ2M+z7V6ySEsAj ljC0L9WumsU0T2l827b0GLzDetLt4oOVm+/Pt+PnLNlvHbiQhd7pFZyqiFYokq8p I3ClBSH8nLUlaW9Q2VtgBupDxEpjU5h4Q+ucl2N+WsD7hgqqnIcu5yPPiECZ0iIE ArSiw/1sv6+qVIoDVFdZ2CmOer5vOAXZk926bAIcJyeVBynfwEmi/Lx5RZfj5m/t THs2PW8LhNzXFXFBN3hupAZbdSZXHKb+xjKTEL5NzTa53rLoCqrII3gWngWESWtt u2DZlxUkl3lW5xeFMjD89VgChSfsWWprAtCJkQ+nAw67O6lgD8pPEQrNoHTF0kTg OIJ/w0TyxFiwfS2ACyhNbFmiDJjk/5ocoa9NZPZ+qOL5m2bHfLOWmBg0IRGYcAqV r9F9i8Pt0o56ysuyWzUpXIb15Yr1y1JPzG/hLS5bh+LMEeap5ij1BGTpsA/dfWaa /hxZGGgovB7MV9IFnK0kEVOKNPsfc7Tf2Wf6lK7swwuKNo7XEoW4OOo/K9J97fRp AuD9bVHK8fKI8vrXCdDSYJ7vl0q7NgePVTmRbYmzmhl+bIJyGS6I9QqHbTPhwcgb ww9x58vccXHRw76HzN9ip3UZESvufayWtACyo6tC7eiRhfPqMW+ZdLi+1VhBeR4J R/VUP4VqM2Gxk+h773rh85p2Io8s+ngSiVoV+42eyMlaBHOEiKG/m/5noGl4H2+k mUR4KOTdEu8YgJhpJolzu/ayhHsv8tZKUf2BSPyYZW6lCgThz+KpjYAE4F49k8uP aWqT4kB60E2KOa9OHV163mE1Y8AuoZbJIWaPPe2iwsM+Ye/irP1toGgipHHz17o+ L/cXU4tPVvjQ7Z1387C4rAMXmuspjA9gNiLnfzS1zZpe+0FT8WPKGwjwaTmaApBT ya0ewM+Ky2mVO+kMASKWYA== Extension name: 6d6yp6wrmo ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0045E3CF95919D8B

http://decryptor.top/0045E3CF95919D8B

Targets

    • Target

      353fb7a00f04bf34de0f9b9cb590900503fe491eb00e236e8201160d709b9eb3

    • Size

      427KB

    • MD5

      5bd321ec41ca42647d6fbd40f73f72d6

    • SHA1

      797d0ae3a36d31e858ab55466ec3095708ff4fb8

    • SHA256

      353fb7a00f04bf34de0f9b9cb590900503fe491eb00e236e8201160d709b9eb3

    • SHA512

      453360625675ab2d1eaf577025e5c03f27bbb64ab2132e1287dec43c0becb0af3292e0746e4158d912e2abf8c8b436b2aed155508275a000a303969ad2e8f8f0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks