General

  • Target

    adb.vbs.txt

  • Size

    116KB

  • Sample

    230809-je1sgahf75

  • MD5

    b86ad4241b01376b3924a380f6f4c934

  • SHA1

    10682d08a18715a79ee23b58fdb6ee44c4e28c61

  • SHA256

    14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

  • SHA512

    54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

  • SSDEEP

    1536:aTZINbRh0SKws6KTUkmHlntMvfWhbpfCqeICS4AKvQIFlswOmZFS0cnwpIGmQwB:FRix3PWhNlOVFmw5q0cifmQ

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$9X0ij8YXhqjLO.H2cLhF2e3Fi/GoedSCGNJn/pT25k02Zpd70dBQm

Campaign

5079

Decoy

perbudget.com

balticdermatology.lt

dushka.ua

naturavetal.hr

directwindowco.com

aglend.com.au

teknoz.net

celeclub.org

kaminscy.com

gporf.fr

2ekeus.nl

chatizel-paysage.fr

sauschneider.info

nacktfalter.de

cactusthebrand.com

philippedebroca.com

katketytaanet.fi

haar-spange.com

uimaan.fi

nmiec.com

Attributes
  • net

    false

  • pid

    $2a$10$9X0ij8YXhqjLO.H2cLhF2e3Fi/GoedSCGNJn/pT25k02Zpd70dBQm

  • prc

    encsvc

    thebat

    agntsvc

    powerpnt

    xfssvccon

    steam

    ocautoupds

    synctime

    winword

    infopath

    mydesktopservice

    dbeng50

    outlook

    thunderbird

    mydesktopqos

    sqbcoreservice

    onenote

    ocssd

    ocomm

    isqlplussvc

    oracle

    visio

    firefox

    msaccess

    sql

    wordpad

    mspub

    excel

    tbirdconfig

    dbsnmp

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5079

  • svc

    sql

    memtas

    sophos

    veeam

    svc$

    mepocs

    backup

    vss

Extracted

Path

C:\Users\627o399m-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 627o399m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5427461206FF740C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5427461206FF740C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: csrwVepYyXqPuHQ85db3nmkFoO1WuIVQZVzkJvehUHHUUudUOjeQXwRbRa0YOQ3N 6EOPwAsOaTh1WFXePFk5Sx3D1xE3Lp7CeGySbprgEe7vLQjY3ka3cpOewjmHkKx9 c88ZbnY3OJXtMczvEEQLS4mb8BkSt7TulrPHZqleY1saCM2u5soj3yf/80yuNPYz L0EanGtDfJFxkLEhNKms5Nl11oHoUoMTmKUYAc4LM8xk3iWz7cbi9bhu4c1j21Ki +SGcUWdR+IDoIe50USRvkvfbgvpcL1x7lJ1I8D60Kj+8ZWqqxD4mM8IXSqlV7Ogg Ph/suWHzZUM0XNWOAOUdxLTkqcVhDvk5ZX9V4pV6AqLUlGLTnJUhXZf60ylee/PI WXvkPaMC9aitxSLS4UxPz/ykW1StaWaXHpjDrxK/A+MdlV95Qrq40Qg9LB2iF4Lw C6bHc7psCE1EurJwon/e3jroC25vaxwFmaGuTCb8OHLhgKbsfAYgRaxaUQWwVSIO ns0TyFeTe/ZNB1kSWMJPqfLKeWTiU+SCVTBywvL0BVcfHLU44yykNlQY2J8Kgp3i u5hgGhglWQxIvcqnLr6+/cg4jGZRVlMW5rI8NJoL/04cpEkbyUp90KviOyT5Afgp eW4RKvglmV93asZ1oj3pTTxQYR6LMyEIh5kcqgmytp8/AkUBRkS/0YuUQ+UMDKYA I5e2z1nj8ZlH1y4uy8l/6mx4ycPD8dkrtAszogA+17munV/K1WVHtNkJUVhb8uR4 7dYVAM3ywUtvA0QY8Ec5qJCppjbNYlbvk+umab1d8pkPLjPHT2OiW92XyfxRmprp SzuekwDmEfGhNUt3Fgf5zDuoxoa1Dgornukh+FebxhioKSVhPjE90um9RA8tuFjA M3JQTXhxaeAThAcPKuMD3y+w6bFekzVO3Ilb6/INWL7ZBqDSode6eBub93fpRQBp NVoQkv5a6ixwhqTfxyB0Re/OdJClZyV87VDA677YqSPTKCliz+mD1mf2Du/0zjeN 4Jo0xcrqWV6LMC5GeoDjgXaDLWNLwgVsjxuXtaidhJIvyeXNMHwo3+GQrxaBJ20R PyNRdsqNrhVOx6HE+0AMATOCAQuxr5YceeLDAty1VTTBSDkROk0hOR3xqS0JTlc2 fKj+KlCqTHrV0+aNWXRAf8xabzIJOS5XP8r35sHOleR/JmrU4lOpBg4f5L1g8PZx G8A25H/YZ8OIT7i5YRBu/JpaCHcD1JgO5Q4kCT3CZXoK2BpOafMQStGzuRU2IM62 wdTPq98+OEPyUjZfQ0RvRcgmA41lkXKjXmNDFWs6bhjmJf1GTYgB8zGm2g1mPMiM 4xIX7Gky+Kit4y2FbkQ6VOPVY5atSxsJ/Na8A894rTN4vYBM ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5427461206FF740C

http://decryptor.cc/5427461206FF740C

Extracted

Path

C:\Recovery\y389ng9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension y389ng9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/21224F673EBCC2FE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/21224F673EBCC2FE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XIyfqvnngpePFBCMlX9/h3zroE/yqjPLhfjbw04BL60+1p7Q3i57jpfSNjyWXSMA R5oeCqyXLFdbBzkfkcgc8rfOIOYydlQUzvK6cdWFo2c8RyDPSHhJ1jYCE/+QcUzd bBrd1WFEG66gmT5HT3yyd8qGtx4UyqRtUyy6lzEWl/KPpMmETegN9O0owevVC3EI M3n1RGBCMQkgtFx9ACxkGoQHjQzLXdGlTnOhXdvIKSoe0ZTtnYFFOHY8z0TYORP+ T8dyB/DvFeBAvhUitmOrjkDpXQwyfZZcMaw0zPudKSDvxbZePYLM3ryA3oX4mObm E7hnU8Y4JPJCJjkUCzs8O64iQUIzS9Or9kOu4NAmJuNFLk/eWJaKmBpD2EERnbiL 2pjJKQcpPr2/QNgm4TMsHzpfs+XBhxH3UuFE6JzPYjclGs1mG0ajuk/ga4QkIAMh Z3M2BUFg+xH3R/fdQLbWWPCsZ5c1KNirlyZFBuIV3xtSxe16JZXSIed5AbJjYzA+ DpUQeuSTRwFJdL/8elt94n1+tEtDJmmn24gICVNZsx26qQ/s64u8FQiO93THp662 jZjmUuoiTWnATmVJzHsxubpKTEeIsSZnAQ7p05jn7Kq9IvW6l7buXEiNjSo/egpv Dyg4ghnrsh4TxQE7R5bT2OuyQTCKlALF33LxE03jVhmMM5fqfKIqHszrOsD1/njr +LsqpwvvEB22PMf+LfhGJ9Jcu5pPriJRLhS03I0J3adLU19NkXxreg8bSmu/NIbd 2GoM7bTmARRx2IXE1Etxc6HNKe6YN9TlB5rTPXYTGUEpFzRqNu2a0fAr0XPgUNXJ I2vIAMNfj9wStwLf5yiKLsGVb4i05GYiHRv2t42DdTzpgfjkndfTGwO/qTCzXRRr lXjCIaVTWbdgt7qDgVET4ATIVejsxqmKr4D87iv6nPMO91TN765p73IXg+wM2RnL 3R0VxTk6CJjleJQFnpcbfIS6Td1TzsH6pV7qITxdcXSZwKvotChrCFHfV2o518oH fUEQKcsNNR1d13WaD0sAsFvBKKLxk22f1nnfqnBhmdJjzVB+o5laxISS2LK3vqod u1PaNT09fZQ7m+19GhSVQr52F+ckcGDcKOCjKsUlOvfnCJGv73aXV26RoCuIWT5P dFZKj7eDpKSyC0tUvSh/4K30qXPgoHOkTf1QvaXua4OAX+p5SiCwahuTdigobaKm +SZImSwJb4LY/Nu6tOJIV6LCy5pAQpdtmFz+V19TOAEqfDwNhOad8ZGwrFwX8KPh 5KDqexe0GOuJ4GkD0tBQMXut9gnCzB+GNJr2ygP5ZQ9HFsVJPlbNhv/rGEuUAY3a XzfXGCkaJFaph8k8xpSKWzEtCfrfmCLh2L8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/21224F673EBCC2FE

http://decryptor.cc/21224F673EBCC2FE

Extracted

Path

C:\Recovery\5myuz6ci-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5myuz6ci. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4EA0548D3417256B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/4EA0548D3417256B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1ldHvOB7HKJsKHzevrmfTNkxNVF2JJ6/wSHOm3p8hOTD1IJm5vs/6o46aFsrk2pX 5+rhciRml/nLd6lAnIlPkV6Xyl021nqaZYPIJpYp1Dq7WFGibAVZIIKrRogE4SDy db5peCEJVsYdPN0q9zq4+HS+GqRI9BFJQF+gEJZ5VacPeKeQvf0XhptzbdKBqNcm a8qghi0bratMjct4vfK+C3Wd/C/W3jnd3gSj6iAA/sR1X30GuG77+pt/753bdI2s lhT1Qck2mUnOMS+orM40XJRJQn2WED/mzDlGzdGRNwJNcZmbeMGlxtkLBS+4Qbzm +HWx21q63XZwF70Jt8PPfZ5Lzy3iz1Z98W5kRpMEznRKdTPLaU4khRPG++DjcUqW KTQU3LqEY9JybKZN1eF2yygeAbmyVlLFrHO57TePxQYTg5lSprc/1yKl09G5wI8n QGHNSl28vwElJHDh/8TBbxJ302DANumQa0jn5jS1pqqTxQ6BINS5AV86geN7cFuL aZ2J9LaXi992QYFEHIMCVUiseEIVgpvK/B9GyoSTCE0l4Kg+s69whTSt0I9GI7uN XQYNi6bDxaSsw9fLwepeDGvv3LCt/mv6bIh2diCNzbx3Rk9oEKqRDL16QnlEUPgv xJ+sEdF/crdf+ybQkCIymhI69cX0WVMWS/0wifuRbWtq4ZmtRuqWWE7VdJK9KXYV PwsgStUYWnB9Nu/L94OIclxvXHNQuMVCwP1GM0rq+pukWAJxxueMx/ufZJtirtyG 00/TeH80L4Nu8zO0798+xD0O/KwV+DdYKwD38sd2QAxjh99fLq2Z5VME4s+ErV1P myC7q+sS80hUXFjPUIFlZRDoWlxqpc50dxP4wFMCsNkaIasXp4NA5J87JBzhZ5TC MvYTCXaOtet1+QUjhPmEzSfNWXZn9FnliXDTwW5ZEbLpglyJ9qGYrWj+DMiCVK5H GJ/mni7cGndvvsYfothj5TRM8aRNntC/x268zs1eyAN1z5lFWs0+IMS96QYaZl4t SbaSQqOPt0n1mvPgbvuWSYUuLSj21Qg8P97zxFvheSOcjYOftQKCWS7chNrmlldm A6+2yeHkgbm2kHAU68tO/OeOO0CBLUSTa9h6kqp0L2r03pWhlxMOlMSQVq9fl/Lo uTGMWmgu5NHY0Lqr0e4XMbEKpqeN+92MurnLkKGPdpETBur8WVFz50msPUG0YIl2 iGPsgXZsJJWEqeDgZuP2T05tNuOcE2Z0oaC9MIfbk8d1OM9yc/MBV1kblplsV1bO tPrPZdq+btdm++3u8eCyzyVbTEH2xw7z/TS/0nvNL/N30Q4yvMf7Y6BJ1t7C3I56 2izYg6D5qaMRnTcKaklIT3G9qLzgPouiTJNL3wiQbuBXsB3BENoPMoTy ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4EA0548D3417256B

http://decryptor.cc/4EA0548D3417256B

Targets

    • Target

      adb.vbs.txt

    • Size

      116KB

    • MD5

      b86ad4241b01376b3924a380f6f4c934

    • SHA1

      10682d08a18715a79ee23b58fdb6ee44c4e28c61

    • SHA256

      14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

    • SHA512

      54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

    • SSDEEP

      1536:aTZINbRh0SKws6KTUkmHlntMvfWhbpfCqeICS4AKvQIFlswOmZFS0cnwpIGmQwB:FRix3PWhNlOVFmw5q0cifmQ

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks