General

  • Target

    2023-05-13_38bb6d3370e91deee960c8aeb6b0a50e_revil

  • Size

    122KB

  • Sample

    230514-jfhchsbb42

  • MD5

    38bb6d3370e91deee960c8aeb6b0a50e

  • SHA1

    ba9e23c4f6e7435e90e92ffef836386053c04ca3

  • SHA256

    8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e

  • SHA512

    532b5f6d68b2526250d1c307cf265b84985ce4c4bc4b00a3c6c05edb051bcc6fa06b64c987de1279746a2c5d91c951aa6c4820546cf2985a1e6d608c0a011b22

  • SSDEEP

    1536:hxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6UdSJOfTo4QVvA3T2+g:hMhQNDEtb3AirfTz0vAVR/6

Malware Config

Extracted

Path

C:\Recovery\yq7er5k-readme.txt

Ransom Note
---=== Welcome. Again. ===--- We strongly encourage You to pay your attention to this message and read it to the end. All Your files are encrypted, and currently unavailable, now all files on your system has extension yq7er5k Before that, all of your most important personal and business files were backed up to our secure offline storage. We took them for temporary storage - but we don't need your files and we are not personally interested in your business. Our encryption algorithm is the most technically difficult and max resistant to burglary. Only OUR specialists can decrypted your files without loss(!) Any attempts to decrypt files on your own lead to damage them beyond repair(!) Best way to you will be consent to negotiations and mutual agreement between us. To connect us you need to download TOR browser and follow the link to begin negotiations.(You can find full instructions below.) We are waiting You and ready to listen all your offers and discuss them. If You will ignore this letter - we will have to sell closed auction all yours private files, photoes, business correspondence, documents and business files + with our analysis of your work activity (weakness of your business, financial violations and the opportunity to profit from this information). It will offset our financial losses. Or we'll just put all your files in the public domain, where everyone can download and use them as they wish. * For TOR Browser http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ We are known as "Sodinokibi (REvil) Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread You have a guarantee that your files will be returned 100 %. And remember, this is only business, nothing personal.. We have a concept of business honor, and we can promise something if we come to a mutual agreement: 1. We guarantee to decrypt all your files in the shortest possible time 2. We will delete all your files and forget about your company. 3. We will show your weaknesses in your networks. .-= INSTRUCTIONS TO CONNECT =-. How to get access on website? You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5EB7190918517BE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A5EB7190918517BE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 9sqwWaEap2al6ssIQub1ljawVJ2uYc727ThI7Dx3/dQviqG8xu3bYwL1EsxwFB+5 Qe7prFnq9m4ZznuzrZ2u56zDMGo8GYvr6l9Kt/scCzah/zeaRwGwF2cJhnkwTiSW hoJe8uA8qikGCYfBQHXC5nLAjo5AZ7kJSX9mC6e5NLXiUn99GgSQFzOo5lB4O4Iz Q/lV2oMl/1zKNRfCTe4UCasKJ8u05VcIoFwqX0j0jm3ogSiZFkyLbwSAcfuNZmMy ugTUGnJMWErjHaqG40vGkdjp28EFg1apT17T/QLbJL7zW7qHeMnWWXbzdPRJqUvy ya802VkjK+bdPPD5nYvGDAzveaP73G5yvC2qtRw5dpI6czeTTOMx9j/FlyhanyrC go6vTW9SNtParZPsCgo6cF82MEqTndD8OpxnZtG511q73P7hwG+FOh8w0U1RR2a9 kiUJnKeJOdvLtR2VNgX7DqXf3AFc3wzt1V2zXdrR5RxkMJJy6wXLsSXgqN0rREEm f0/AYEA6opKR0BGmo0uBVOdjLjs20VGcmCZFIMUI1UcTuf74lDhlEmYXdGisjJvc jthKrDLHP+WEs3SpQnMIaB/ZzampVI1GIogXbdi0XFtyOw1D2crR+s020O71WwnI bM/4xsRxfOXx5JeLwaFdcsGiATQAwvs4cCmcFxbqlbHnkr/jGsgmx0kOEQmqBAVm ztybn7lvaffV2EIssQITIVF1n32lpgNmLkGY3XBF4oxuQL4ni6VUyj2GIRsCwnlW 8wrbzckEM4BvAPIgvzh7qrYhgotGy5mxgSK4qesaC99an9In/3hrfUvw2iXGNjTN o61bekOivMnup/+livhfxPYs1GCl4ogJqgJCjHFzr8jX3SrhbqOFoG2jtetHZdKP nSJlWUCfhVctp58Malr7AHwXCBjTcMr10x5NACRqXzlF2NH6AIx7qAcy6+S8RHhk lOb5khB96G9bSxF9h540l2thYXBHdyG/XVem61Q4YNeGJQ2iNNoUMP7orSrqS0Xg hvJsX3dprL3DDVdF14ZEHY4kSY9bYnpq5wS5N7z/DvxBUS780l1guPveg8nIw/UI KyAvm5MX9DL7bBd494lUf7liFedRuj9Of7bP1RCkmPKrL2lcRsx9MNJl/ASmTDs3 LBviYDm8WIcE7+RCEms54smvQXOx0Ag+aTP4yxBkhmN7DnzI3K1Z7vQzj4LpcyCH VBrfcL519cIsaZVEnHLuZ1mRU+r0/70MLmIEyk4iHVu/R/aFFG7U68XVvCTeEQ9z /yLuzYW8IRA5ifzaBaJb+57KMcywGw== ---------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all your data!
URLs

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/

https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A5EB7190918517BE

http://decoder.re/A5EB7190918517BE

Targets

    • Target

      2023-05-13_38bb6d3370e91deee960c8aeb6b0a50e_revil

    • Size

      122KB

    • MD5

      38bb6d3370e91deee960c8aeb6b0a50e

    • SHA1

      ba9e23c4f6e7435e90e92ffef836386053c04ca3

    • SHA256

      8ece3ce00a84b7365b96487f215cbbea379a8df57ed7c23a2add8758858fba6e

    • SHA512

      532b5f6d68b2526250d1c307cf265b84985ce4c4bc4b00a3c6c05edb051bcc6fa06b64c987de1279746a2c5d91c951aa6c4820546cf2985a1e6d608c0a011b22

    • SSDEEP

      1536:hxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6UdSJOfTo4QVvA3T2+g:hMhQNDEtb3AirfTz0vAVR/6

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Impact

Defacement

1
T1491

Tasks