General

  • Target

    95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab

  • Size

    205KB

  • Sample

    220625-g75k1sbff2

  • MD5

    44ff381ecebea1fe136af55f3200417c

  • SHA1

    83fb890c3baf5dbe0ae06621fd363fbbbf219c2c

  • SHA256

    95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab

  • SHA512

    7273f23a314e09d3f4726f0ef3f7e59ea0dd02f3e2fb4df4b45932f7ea5180e98c77416f2254cf7b4eabb5a82351a6b97976bbc6fcfd86b2d99dd1928aba7c6c

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

1428

C2

centuryvisionglobal.com

rivermusic.nl

tastevirginia.com

rentingwell.com

irizar.com

hepishopping.com

osn.ro

raeoflightmusic.com

kellengatton.com

leijstrom.com

gurutechnologies.net

laylavalentine.com

kookooo.com

eyedoctordallas.com

artvark.nl

ownidentity.com

goddardleadership.org

sharonalbrightdds.com

hekecrm.com

rename.kz

Attributes
  • net

    true

  • pid

    19

  • prc

    sqbcoreservice

    msftesql

    ocssd

    infopath

    mysqld_nt

    dbsnmp

    powerpnt

    encsvc

    isqlplussvc

    mydesktopqos

    steam

    onenote

    tbirdconfig

    sqlservr

    agntsvc

    sqlwriter

    thunderbird

    xfssvccon

    thebat

    synctime

    mspub

    firefoxconfig

    dbeng50

    ocautoupds

    ocomm

    wordpad

    winword

    excel

    visio

    mydesktopservice

    outlook

    thebat64

    sqlbrowser

    mysqld

    oracle

    sqlagent

    mysqld_opt

    msaccess

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1428

  • svc

    svc$

    backup

    vss

    mepocs

    sophos

    sql

    memtas

    veeam

Extracted

Path

C:\7u1p060-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 7u1p060. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0CB18DBA9560CEE4 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/0CB18DBA9560CEE4 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: J3eEWv4KwHiPcv3U2KC7XOzPA2TIuYqp8U5wfOkBoHWVGk8lmQm8ELEzCKOuPwB5 svQzR2cnFzxfVRSDwSdYgoOVtbiHSK1Fgvmq/E9WpVmsBcuBoy6t5t+AMVZcrisx 7atpDql+IItM5B74mcE2+wH5A8SRYgdOITpNrFq3dnZXC4vsHZI9o52ZHCIWnOtz 3IHwQ5ftOg+/5AVq66z3AMEEk8JuL3jvg3WtPckE72bMYG7CT5cp38sHGnps/3Y9 WvyW34T3xOy5etTKnH3BGtWHvH6Q/L7VMzkLFY04RAPbNa0McX//V2YpdK5xou2b siQZjUCSX1yySBrdX6XRI76rYbYi+xVksQvSUuh64RqnuiRwc0wEGy4S4J4Qo+GE FLdjcsStvhsnF330oIKw4wZxlXeJjaIS7XYt0OC30Q+4mDLNpF/xMlg/LKpI82UC N+2YgLzWQCJblfQe+VraaTejltLTWrvHxCwnQ/QEY8m4FQIo9fnBmkggxkZ56pJE nu0zfd/uHxTqjxcqzDIuR5nycepGWQ5LYX3SgN3U5SllKEaTWqUq6T1AjRXlHxL4 TCpPvRTkYUWjSeRGg5BsDv0kpCmj/VgbSYcBXMYDmixbHLcrQVTVuMvtRVjxsYdd eOXM3ZAN0UoDJyBjyzzt5Bmc5KEj1l3MptLhYatDeJTbHg/X6lBRHrnWxic8mbyx AH0VnKc/YqUBQk+SVnBO5CwJf2WV1e+UvT/JS9piFC8ypcWKcLkCUloRWLzfILZR d+bbxTGoQoVV1HFdmewoISVMW6dsu/uE4dZ/zfSqBO0lMSzkTrxhOIxcNmMfcvfn oUAf9W4xNxUzLjq/70CbhojGCTiwmji/PLjp4PHbqCQXMg6Z62wSazB7/LDvWBS0 dyv5B5NhpxQWMxzQ25r2tsY95wcgU33sV8IqxpEy23ZT0CMs3favU/09EidAqIEd TPkv5G4hfQYyx+j3qG2qodljCtke2+SUwnS0tBojcJmfYly+iQW5mmrACIJJ32vF rrca3JppbkXaGcPvN6fT2xmil/ZaNhuIv+mfy54IVhXY4LIhvJMg5yQoXmuVrmNw ZpHx372pzW6rjNJhlTd4/4bUnVnCFn3nbhqR9/Tg9He1mqJSix8CCI6YEyfSu/qN DCCMLdJvxoGlyIIC Extension name: 7u1p060 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0CB18DBA9560CEE4

http://decryptor.top/0CB18DBA9560CEE4

Targets

    • Target

      95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab

    • Size

      205KB

    • MD5

      44ff381ecebea1fe136af55f3200417c

    • SHA1

      83fb890c3baf5dbe0ae06621fd363fbbbf219c2c

    • SHA256

      95cc4811d704d4d5f4e08d7bb2e24a8fe4e1082d22dfbd30c3da4518e73ceeab

    • SHA512

      7273f23a314e09d3f4726f0ef3f7e59ea0dd02f3e2fb4df4b45932f7ea5180e98c77416f2254cf7b4eabb5a82351a6b97976bbc6fcfd86b2d99dd1928aba7c6c

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks