General

  • Target

    2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c(sodinokibi).zip

  • Size

    77KB

  • Sample

    230323-k8zb6sgf5v

  • MD5

    1cdd591e3505bef21cd47f8f43d36a54

  • SHA1

    2cbf8b7a597f5f58c7a94ddd8df02889019db8e8

  • SHA256

    89d7faff53bd5acf6e71d15d499a093a5cd420311d86daafecb51eca6aa91608

  • SHA512

    aea358106358e09ac2faa649cf78961dfe279b1b8508ffb849eaba49adf924c360a5caf2f3417e948a733e19db3beee961d41e9bc3b29c5b29f3e91687a730b4

  • SSDEEP

    1536:oQQ0cc1gGq/zru6RfwWY2UU5NkOma9+vFA35Tk0dsSAVY22ZmX5S:vgtb2J4kOX9Y+d+DVUGY

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma

Campaign

7114

Decoy

withahmed.com

scenepublique.net

aglend.com.au

jyzdesign.com

nsec.se

cirugiauretra.es

gopackapp.com

tinyagency.com

crediacces.com

xn--rumung-bua.online

bowengroup.com.au

mastertechengineering.com

kmbshipping.co.uk

homng.net

fitnessingbyjessica.com

oldschoolfun.net

roygolden.com

sotsioloogia.ee

real-estate-experts.com

mir-na-iznanku.com

Attributes
  • net

    false

  • pid

    $2a$10$mKbuAybjn4W3ipQCt6E7ROYxmL5SSZgUbPuA7PKUsPqJU10KB4bma

  • prc

    oracle

    klnagent

    mydesktopqos

    infopath

    BackupExtender

    powerpnt

    outlook

    BackupAgent

    Smc

    sql

    ccSvcHst

    BackupUpdater

    Rtvscan

    winword

    kavfsscs

    ocssd

    isqlplussvc

    visio

    ShadowProtectSvc

    tbirdconfig

    TSSchBkpService

    dbeng50

    ccSetMgr

    agntsvc

    Sage.NA.AT_AU.SysTray

    dbsnmp

    thebat

    onenote

    AmitiAvSrv

    wordpad

    msaccess

    avgadmsv

    thunderbird

    BackupMaint

    Microsoft.exchange.store.worker.exe

    CarboniteUI

    excel

    SPBBCSvc

    LogmeInBackupService

    encsvc

    ocomm

    sqbcoreservice

    NSCTOP

    mydesktopservice

    kavfs

    kavfswp

    ocautoupds

    mspub

    xfssvccon

    DLOAdminSvcu

    synctime

    lmibackupvssservice

    firefox

    steam

    dlomaintsvcu

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7114

  • svc

    Telemetryserver

    "Sophos AutoUpdate Service"

    sophos

    Altaro.Agent.exe

    mysqld

    MSSQL$MSGPMR

    "SophosFIM"

    "Sophos Web Control Service"

    SQLWriter

    svcGenericHost

    AltiBack

    "SQLServer Analysis Services (MSSQLSERVER)"

    BackupExecAgentAccelerator

    "StorageCraft ImageReady"

    SQLTELEMETRY

    AzureADConnectAuthenticationAgent

    ntrtscan

    ds_notifier

    TeamViewer

    "StorageCraft Raw Agent"

    "StorageCraft Shadow Copy Provider"

    SQLTELEMETRY$SQLEXPRESS

    VeeamHvIntegrationSvc

    AltiCTProxy

    MsDtsServer130

    ViprePPLSvc

    McAfeeFramework

    MSSQL$QM

    "swi_service"

    "ThreadLocker"

    ofcservice

    AUService

    sophossps

    AzureADConnectHealthSyncMonitor

    Altaro.OffsiteServer.UI.Service.exe

    "SAVAdminService"

    ds_monitor

    ALTIVRM

    SSASTELEMETRY

    TmCCSF

    MsDtsServer110

    "Sophos MCS Client"

    TMBMServer

    SBAMSvc

    mfewc

    "Sophos System Protection Service"

    MSSQLFDLauncher$TESTBACKUP02DEV

    VeeamDeploymentService

    masvc

    backup

    MSSQL$SQLEXPRESS

    AltiPhoneServ

    MSSQLServerOLAPService

    SSISTELEMETRY130

    VeeamEndpointBackupSvc

    mepocs

    Altaro.UI.Service.exe

    "ds_agent"

    HuntressUpdater

    MSSQLFDLauncher

    "Sophos File Scanner Service"

    SQLAgent$MSGPMR

    ADSync

    KaseyaAgent

    ReportServer

    MSSQLFDLauncher$SQLEXPRESS

    MSSQL$HPWJA

    KaseyaAgentEndpoint

    VeeamTransportSvc

    "ds_monitor"

    mfevtp

    MSSQLTESTBACKUP02DEV

    SQLTELEMETRY$MSGPMR

    ThreadLocker

    MSSQLServerADHelper100

    veeam

    tmlisten

    AzureADConnectHealthSyncInsights

    "swi_filter"

    MsDtsServer120

    ProtectedStorage

    VeeamDeploySvc

    memtas

    ds_agent

    VeeamMountSvc

    HuntressAgent

    SQLAgent$SQLEXPRESS

    bedbg

    MSSQLSERVER

    "ofcservice"

    VipreAAPSvc

    "Sophos Endpoint Defense Service"

    KACHIPS906995744173948

    DsSvc

    MSSQLLaunchpad$SQLEXPRESS

    msseces

    macmnsvc

    LTService

    Code42Service

    Altaro.HyperV.WAN.RemoteService.exe

    LTSvcMon

    MSSQL$SQLEXPRESSADV

    "SAVService"

    Altaro.OffsiteServer.Service.exe

    "Sage 100cloud Advanced 2020 (9920)"

    Altaro.SubAgent.exe

    mfemms

    "TeamViewer"

    "SQLServer Reporting Services (MSSQLSERVER)"

    VSS

    sql

    Altaro.SubAgent.N2.exe

    "SQLServer Integration Services 12.0"

    SQLSERVERAGENT

    vss

    "Sophos Safestore Service"

    klnagent

    "Sage.NA.AT_AU.Service"

    MBAMService

    "Sophos Health Service"

    SQLBrowser

    MySQL

    "ProtectedStorage"

    "Sophos Clean Service"

    "Sage 100c Advanced 2017 (9917)"

    "SntpService"

    VeeamNFSSvc

    KAVFS

    SQLEXPRESSADV

    KAENDCHIPS906995744173948

    sppsvc

    Amsp

    psqlWGE

    Microsoft.exchange.store.worker.exe

    kavfsscs

    "Amsp"

    sqlservr

    Altaro.DedupService.exe

    svc$

    "ds_notifier"

    "Sophos Device Control Service"

    AzureADConnectAgentUpdater

    AltiFTPUploader

    "Sophos MCS Agent"

Extracted

Path

C:\Recovery\zl5x0pkd5n-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension zl5x0pkd5n. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). =========Attention!!!========= Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. ============================== [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E1DC5262C02EB930 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E1DC5262C02EB930 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Wn7Vq1J8qYGZmpZx87Vm4IenxCnPV5RjeD4dJ24S/3iOH2KZlLsiKnte6kwM53Tc bJ+hnqZIQgkjJTlIy2wkz/a7YsIKRLhRe5C3nwF5FWpCRs71mbddIZvYhTWtaDHv jVmX83pRWKVkGTKOc8UVhQfWT6fn84bVpAJ3yo4RtwVJf8yF1TYM4Ogu4xYGs5R1 ybCrIg4yG4MtJL8F22urUGtsq0pVaYkjAu6gjIcbzN/HVqCcl7rtN9sNmUwo1cUs O9IXDT7aE7CiDfPHrbsvNzCVURvWJn6tkKCMJMcESwjuLuP20IkXK+ZW4J8RNBHd DTUH4IsD4VRRhbH5JcOrlIQ1BeQDL8mRrQuq/9bZLncYpEmOCav2qZD0eRPf8uI2 gOKoEyKMgJ+uscEXzXfYjsyZSu9o308MH8NYObbH6c6kr0b78NIBL7e/J5Nq6jxx 0B/vpWG5nkn06kdoTgnjFEzGWd2Z+DPGDwxQqIV2wFA+wcT329yO+HLDf4Q5V5Sn 8T7raNRHi0DCyfK7nfWJNHYn2c+erOGFuTmuCoVUzlpfTZ0HBTtEN0z1gsJ37JoD cuPjlzfv5dcopGiULJg3B3gKTQVvtMkKmqhBFthSXvfin7F/VUyESO3jD7uYy5Zr pHz88uabHiPNkjI3AZf73tTU/IvEcKkxWMVEK7f3S42gpVZEsdloUK0z2xgrIChZ r17273emKaw8oTXp6ai0lxzcwrDWP/d4r4Dm4QeZ344MHO31kzRli5tQ8NhOVw9v kT28SaHEYd1Z8fHYb5eDSXix52fQMNl6Ouayn2lMl0hodZPZ4bZ9yLqPiZnBwEID /is0phbAZK16e205FAkCd+OFEKHOZo+NvzNB354rl+uOIpl8BXRy5bHv421E0yGI cNASmFUNTftxzaCJqYI85eE2o1VXliKX44cTNokfUQl28urjyV+lpfvV4g/2zmMi dBBFHFFdO3fKpNlWWvSA5FoThcppyblfBlKnc15lDCZolQUHa9tqD9Wk1pL2mviG YycAEJQcLiW7eNUxnXBPJJtUFn1A1taizFysl9QscvZDLloVlml4cpcrDfQBbA9g SISFJYkWWDKrRfuET5N0iifRqD0J/D5Paa8mXSH/1gtN+5CHWpUBgnOsiWpa94sS Dh3hkXlm0PwDUBQEIAAnLJrdN93YsB6a9Ga16XKzUcK2kfp2C5puBME2LQ6VCOBX ClkXwMgVIXN87NbEpnr4kd/0vYhN+os5D2B3nxyegKx5RmxeCyTJeLhAV+Sqig8S 8jHBeE9Rkg5uO601i5O/2MqVA2iBRAZrXBTNhw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E1DC5262C02EB930

http://decoder.re/E1DC5262C02EB930

Targets

    • Target

      2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c.exe

    • Size

      120KB

    • MD5

      af94ccb62f97700115a219c4b7626d22

    • SHA1

      bb67edcfe4e5b6fe09ee96e5b8ace7a4cfe39eb7

    • SHA256

      2896b38ec3f5f196a9d127dbda3f44c7c29c844f53ae5f209229d56fd6f2a59c

    • SHA512

      08c05f8dc98aba168734732d043c3e403f531522e0ec0ec64484d15375f353aa23f9654852ad2c54a3e6b2a9344f4ffb553cac24455f62bb65b55800e311c12a

    • SSDEEP

      1536:J8A4krBJLarHZZd/M4PI8iwplAXpzK88ICS4Aer9DIPcG5zXbwMcClFyFfjRto2C:+/LPrlAZZE0cOzbwMflEBPo

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks