General

  • Target

    a27a783e16fda91874b4885fd874c0018b82dec16061d15d8c701b61541d9d86

  • Size

    164KB

  • Sample

    220625-chvx3aaabn

  • MD5

    cf36089d8aada316b4188e74ae11dc58

  • SHA1

    89270cd7f54b8d386b2a952ff71a934588035da7

  • SHA256

    a27a783e16fda91874b4885fd874c0018b82dec16061d15d8c701b61541d9d86

  • SHA512

    ac6ac6a919cd18b4d0fa7af95b69d180bef5b5aba65a93752bf637465082c00bf74239c5aa41396ed6df2a0a6215ba86d71e1bacd5a05dbd1c89b9a7f458a9c3

Malware Config

Extracted

Family

sodinokibi

Botnet

29

Campaign

1101

C2

web865.com

blavait.fr

johnkoen.com

amco.net.au

krishnabrawijaya.com

vitoriaecoturismo.com.br

mieleshopping.it

racefietsenblog.nl

schluesseldienste-hannover.de

xn--80abehgab4ak0ddz.xn--p1ai

yayasanprimaunggul.org

mbuildinghomes.com

pureelements.nl

go.labibini.ch

datatri.be

vapiano.fr

startuplive.org

mrmac.com

adedesign.com

fann.ru

Attributes
  • net

    true

  • pid

    29

  • prc

    onenote

    msaccess

    sql

    winword

    mydesktopservice

    dbsnmp

    dbeng50

    visio

    encsvc

    xfssvccon

    wordpa

    synctime

    mspub

    ocautoupds

    thunderbird

    isqlplussvc

    ocomm

    steam

    oracle

    ocssd

    firefox

    powerpnt

    outlook

    sqbcoreservice

    infopath

    tbirdconfig

    excel

    agntsvc

    thebat

    mydesktopqos

  • ransom_oneliner

    All of your files are encrypted! Find how to decrypt {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1101

  • svc

    *vss*

    mepocs

    veeam

    *sql*

    sophos

    svc$

    *backup*

    memtas

Extracted

Path

C:\how to decrypt gcfhmou7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension gcfhmou7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/01C22517C64F4429 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/01C22517C64F4429 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: bIkMVG5+mgZruJA0aju1dyKHu/MsqPSuA+dsDxbPyvvahsp6ydsi7uscVwpYoiVU eDAvBnnasYASGfOSIN7E+DDPNgKs14mnKHxDW4tlK+9aKEMCip55NWAdI8BUPzhR GNYa4opgw0rMGOrzS8tmOH7k0YV/Y6x/bPYFA9tLx7GlF3dKny3mSjbaDVrjdil3 wtbPj8d+oMF5bo0BpLxrZlgQbWknN2+GUCl2eBrS3H/Ttn925XzhAacka2JLYv58 3DHDGwnfi03NASbsQfkdPBOMLlErJvlRmB1AweHuCEo+YbMdBNxPDpV1MHdEqNZe r6av8wmM5TTIpe4y4L5le30/Q9XG5bQawMV99s8gZVANGlVtryct2eY1nAET4+Ad xVUpTh9F8ddEQ7Uv578oRdGe0zQMpQb55GKc76gFYQWeVFBBZoGO0NQtpMikeZ/z TtVB1Cg9aJ1pyHh9GQi+UcqaasT7dgPTh2JB9Cz0q+Nfnf7J25JCqtTeKJaR4Yj5 qmme6/IwWgaOhOuNIhIeyl62Jm25DrXRUjnoUBmma3E0k2xoxgfd0q8dyP5H5SHu L7jA7yTVv/uRbFfifcDkA3nJrp+3COBIf6Q+fvdbKoNV2aOcxjmfNFl59KbDcXI1 svA3Xf/jqC9NolaWgX1h4O28ZaaflQNBxo1C6ChzkuOdjJ5cxWdd7bF0JIDoLCjj +f6h2NFvF8KnA0QGUIO/wokvpdpQF2corHJ0zJTD3ZFKIDYYIfUooZJaEdbTGHRu 725aJP21sAjiMLC9TZMm4SjtaHwOeCERGT8MP+ycHKhKKoOx6rdHl6X86k4yBkuc 1fHFbGjQybgimaNQoc4vVzWN8cuBvFC1ERnlwU1R53nuHiXwjPE9/8F1kzq+n673 /nO1He3M7XPzs+7oCYaPWMqRN+ZmiCYcW2iSjISJDx7lSFcCfhEKpXLfx0zxyx62 FeobrOQMeWCnGgQOzJasNGBEBKp77h3k/YDXgDAAHg10BjiZJE/SsafV9/ImF9lv BEkdYb83QA15jc3v5pOTRqPxn3t8mEBlIf6pGdPcYF5I9q0KdR0etDZwCYPpKtRO Hnn20Bk4JQgALuzMLRPEs/G+pdgHwY+GqqJbty3tWKeJbahzZNi23dNHd0+oSOUo SfXpIEaSAo+rFrjBA3o= Extension name: gcfhmou7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/01C22517C64F4429

http://decryptor.top/01C22517C64F4429

Targets

    • Target

      a27a783e16fda91874b4885fd874c0018b82dec16061d15d8c701b61541d9d86

    • Size

      164KB

    • MD5

      cf36089d8aada316b4188e74ae11dc58

    • SHA1

      89270cd7f54b8d386b2a952ff71a934588035da7

    • SHA256

      a27a783e16fda91874b4885fd874c0018b82dec16061d15d8c701b61541d9d86

    • SHA512

      ac6ac6a919cd18b4d0fa7af95b69d180bef5b5aba65a93752bf637465082c00bf74239c5aa41396ed6df2a0a6215ba86d71e1bacd5a05dbd1c89b9a7f458a9c3

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks