Overview

overview

10

Static

static

full.enc.exe

windows7-x64

10

full.enc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    full.enc.bin.zip

  • Size

    119KB

  • Sample

    221009-vgqwtshdgk

  • MD5

    be9c59183353af01fb3cb23055948e42

  • SHA1

    c9fe087cd656f1d63c378e55ef9f47bb330a5be1

  • SHA256

    552a04ca5020935df7c5a6f5e257ccba99760aebe8bf2c0b36a2bb93a338b370

  • SHA512

    f11c72384cf36c0a5ee1df837721645a94356ca97c6bd9a72702b65817709c6214cb93afdd4e002dd0e91bf2f2af3226f39375666ed576005e517bac504ecfe9

  • SSDEEP

    3072:9pnROygro41X+1d0yICXGEXlA2pYfPG88K0dhaoxh0OfmGH:1OB1O1mV+GEXlAQbpdhagh0Gn

Score
10/10
sodinokibi$2b$13$smhroaoopkdhdonl/mu1f.ngqdxcrizvxx5jgju1ep6jzpd9z7w6o143ransomware

Malware Config

Extracted

Family

sodinokibi

Botnet

$2b$13$SmHroaooPkDhdonL/MU1F.NGQdxCRizVxx5jGju1EP6jZPd9Z7w6O

Campaign

143

Attributes
  • net

    false

  • pid

    $2b$13$SmHroaooPkDhdonL/MU1F.NGQdxCRizVxx5jGju1EP6jZPd9Z7w6O

  • prc

    vsnapvss

    EnterpriseClient

    firefox

    infopath

    cvd

    tv_x64.exe

    VeeamTransportSvc

    steam

    encsvc

    mydesktopservice

    outlook

    synctime

    ocssd

    SAP

    cvfwd

    bengien

    vxmon

    bedbh

    ocomm

    ocautoupds

    raw_agent_svc

    oracle

    disk+work

    powerpnt

    saposcol

    sqbcoreservice

    sapstartsrv

    beserver

    saphostexec

    dbeng50

    isqlplussvc

    CVODS

    DellSystemDetect

    CVMountd

    TeamViewer.exe

    dbsnmp

    thunderbird

    mspub

    wordpad

    visio

    benetns

    QBCFMonitorService

    TeamViewer_Service.exe

    tv_w32.exe

    QBIDPService

    winword

    thebat

    VeeamDeploymentSvc

    avagent

    QBDBMgrN

    mydesktopqos

    xfssvccon

    sql

    tbirdconfig

    CagService

    pvlsvr

    avscc

    VeeamNFSSvc

    onenote

    excel

    msaccess

    agntsvc

  • ransom_oneliner

    Follow {EXT}-README.txt instructions

  • ransom_template

    === Welcome to LV === [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have {EXT} extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] ATTENTION. YOUR DATA 1000 GB IS LEAKED [+] All your important documents was downloaded. Data leaked includes: - Databases - Insurances - Finance - Employee data - Clients data - and more more more... If you do not contact us within 72 hours, the incident will appear on a public blog read by the WORLD media. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://l55ysq5qjpin2vq23ul3gc3h62vp4wvenl7ov6fcn65vir7kc7gb5fyd.onion When you visit our website, put the following data into the input form: Key: {KEY} !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!!

  • sub

    143

  • svc

    QBCFMonitorService

    thebat

    dbeng50

    winword

    dbsnmp

    VeeamTransportSvc

    disk+work

    TeamViewer_Service.exe

    firefox

    QBIDPService

    steam

    onenote

    CVMountd

    cvd

    VeeamDeploymentSvc

    VeeamNFSSvc

    bedbh

    mydesktopqos

    avscc

    infopath

    cvfwd

    excel

    beserver

    powerpnt

    mspub

    synctime

    QBDBMgrN

    tv_w32.exe

    EnterpriseClient

    msaccess

    ocssd

    mydesktopservice

    sqbcoreservice

    CVODS

    DellSystemDetect

    oracle

    ocautoupds

    wordpad

    visio

    SAP

    bengien

    TeamViewer.exe

    agntsvc

    CagService

    avagent

    ocomm

    outlook

    saposcol

    xfssvccon

    isqlplussvc

    pvlsvr

    sql

    tbirdconfig

    vxmon

    benetns

    tv_x64.exe

    encsvc

    sapstartsrv

    vsnapvss

    raw_agent_svc

    thunderbird

    saphostexec

Extracted

Path

C:\g134d8z9-README.txt

Ransom Note
=== Welcome to LV === [+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have g134d8z9 extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] ATTENTION. YOUR DATA 1000 GB IS LEAKED [+] All your important documents was downloaded. Data leaked includes: - Databases - Insurances - Finance - Employee data - Clients data - and more more more... If you do not contact us within 72 hours, the incident will appear on a public blog read by the WORLD media. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should visit our website where you can decrypt one file for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. In practice - time is much more valuable than money. [+] How to get access to our website? [+] Use TOR browser: 1. Download and install TOR browser from this site: https://torproject.org/ 2. Visit our website: http://l55ysq5qjpin2vq23ul3gc3h62vp4wvenl7ov6fcn65vir7kc7gb5fyd.onion When you visit our website, put the following data into the input form: Key: tDaLR2n6kX83JSkPzkeB+eNBdAJIbHSKwZygbGVUR4PKcmxuc6VtBmSf/oKJYB8c IWMNAHRjFaelM4jnny/0SHr7fgysc54GqwunV7v4YAYG4FuJtRl5NnJcNBDuXxoJ 0wXnISBgfW/5yuFMsZSwzFpvTk1zg94o2Lk1wx6M9tPzM72uavVb9Px9zx2TQQD4 13RHqj8zwO+X/JL9R3OqzHdK0vguWhJsmNsAs69+W+aI/mEPNe8+IKYPTz1ql69D dw1NaqCMw6aMIgnJkAuWvSECLpIFhpcyt6FxU0MnFr9qVNtAUGRoWksZRoXhxzp/ DdU049PpL61qcNdi3weH/DPaTbzyuGzydeYzIj0NSQiR+YZgoSPdr4DJ1QbZ7K0r yrQOh0GZpfp3rZAuWtEL5RKiVG3OAwGxs25o5fbqcbfyC/eTaUkqEzE9ESMKrD4x lVKJAPb2M7qkCEdZkV3IoR527fAHX0uj3zJ+A7zCDmbnzC2wws/AsvaK6vtM/2X/ eDLO2OuzU9l+5OKwKv/q+jo3IZyd+T0V+8VZP+JGk/ZUeQOyQOLw+M7rJzAGAKv7 p2vG6NTkPeAvGBk0Coett3hPlkJfU6XXrMWpN8xYMg6bZfZkr8dA+fSvU+ocZbhe X9ks47EFIHRZ/GvtaE+tWBTg4+mNVvLNZAKEKrYpcdJxERI1XTa5iQ6CKqp3465o A43i5TNtEQx+YvoKvUGmCbfxYK/LNRbE/qHvmeLvwIWdNd/6LHtktvM7ft7l6r8k /wKOePxl6V5d6RYZQ0AZ6sF1/X9+dSbt+0dFKWcI6M/GBrw4l5TS93RtUGPCaplG Ry/57mhRWByms0uOXPhPW7OLY3tQpE25eujaIQLOZuy5SGzhNlca7H9j5qcCDuQ/ zLN1KxsQLlZ32usIdbtdniA6Jweg5ezNXA/0tWzbreb1UqbeE8xHIMSbQWi2BkJ4 sOn8mHe+sNYOIGh1cjQZND8PrTz8UuRWP0g2WNiFx2T6AAnR16jRBmCtM7GSYZ2i KxaQzsYBfHf9P/UGHGFFy8F6nuVVhi+yYRFhPgFdJ+nQeuCR5S08tLhmvE8EYoyR CJ3Rvu58l7mHtwi6tEbWWJUA7HvBs1jgLfZ7PAT1y3Dwj3z/cRDH7/PI4sZOi+MA i95++YXg5W2uqthti1w7joIztav/J9PX6dIfwIBGMSQIWJ2I0QIrIpco3QUYfde5 PwsUueRFCHbqST36a5M+P4ivc+T90TDUo10+D5TRQREYztwYksp+NLxDDfdMGuB5 3tugalJyCIBP1scW1s4ixeY9sYMyUTdycZknKzS2cMI= !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we (the best specialists in this sphere) ready to make everything for restoring but please do not interfere. !!! !!! !!!
URLs

http://l55ysq5qjpin2vq23ul3gc3h62vp4wvenl7ov6fcn65vir7kc7gb5fyd.onion

Targets

    • Target

      full.enc.bin

    • Size

      121KB

    • MD5

      fa1b150ec4130c49486338149678b19f

    • SHA1

      a6795b072c6817078c122ab6aed99695602d047f

    • SHA256

      5e9730afe5cd839e717f130be156c12ae2d7dd4d91116963eefc48b04eb83663

    • SHA512

      5df6c3c69c44c4bca51f427980c424b4fbb830e087b5866f5f35ff4b91c3c39c502f46133509b94c4fd0bf8616cc1732db1259992a2f19f214751c069149a952

    • SSDEEP

      3072:6WcHSdO86ssy11HUvfFJYZzJvCuv54sfVzo5016R:6wdDHHUFOquvdVzrW

    Score
    10/10
    sodinokibi$2b$13$smhroaoopkdhdonl/mu1f.ngqdxcrizvxx5jgju1ep6jzpd9z7w6o143ransomware

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks