General

  • Target

    adb.vbs.txt

  • Size

    116KB

  • Sample

    230810-ay7wfsge95

  • MD5

    b86ad4241b01376b3924a380f6f4c934

  • SHA1

    10682d08a18715a79ee23b58fdb6ee44c4e28c61

  • SHA256

    14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

  • SHA512

    54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

  • SSDEEP

    1536:aTZINbRh0SKws6KTUkmHlntMvfWhbpfCqeICS4AKvQIFlswOmZFS0cnwpIGmQwB:FRix3PWhNlOVFmw5q0cifmQ

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$9X0ij8YXhqjLO.H2cLhF2e3Fi/GoedSCGNJn/pT25k02Zpd70dBQm

Campaign

5079

Decoy

perbudget.com

balticdermatology.lt

dushka.ua

naturavetal.hr

directwindowco.com

aglend.com.au

teknoz.net

celeclub.org

kaminscy.com

gporf.fr

2ekeus.nl

chatizel-paysage.fr

sauschneider.info

nacktfalter.de

cactusthebrand.com

philippedebroca.com

katketytaanet.fi

haar-spange.com

uimaan.fi

nmiec.com

Attributes
  • net

    false

  • pid

    $2a$10$9X0ij8YXhqjLO.H2cLhF2e3Fi/GoedSCGNJn/pT25k02Zpd70dBQm

  • prc

    encsvc

    thebat

    agntsvc

    powerpnt

    xfssvccon

    steam

    ocautoupds

    synctime

    winword

    infopath

    mydesktopservice

    dbeng50

    outlook

    thunderbird

    mydesktopqos

    sqbcoreservice

    onenote

    ocssd

    ocomm

    isqlplussvc

    oracle

    visio

    firefox

    msaccess

    sql

    wordpad

    mspub

    excel

    tbirdconfig

    dbsnmp

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5079

  • svc

    sql

    memtas

    sophos

    veeam

    svc$

    mepocs

    backup

    vss

Extracted

Path

C:\Users\835a63va4p-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 835a63va4p. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0F2C8840A1F62CF1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/0F2C8840A1F62CF1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Nw/pNgtGfOZEqdadVkoaJSxBR3Sb1KzRuC1IU5ZtJ51woDRt2Djk1eIJ0fjFK36D m3wPVZOX+eU0YmFsp++uilXWOBRT+r8OGTPPNqmrJlUgK8+9IyEqItpn/ET7YMSp e5QpzN9aFXLaJwbFHIZeI5+Z/j6RwnDxki6kkrZaxE5zn11S/iMUS6VU+nQkgZz6 +hTESBGBN7HshbKquvw7AS8w8Dm/6QfyIhdqeIEl6f/zd0yd4yRF88TDrT9UmC5Y DcXSfGFCCo9TqAzZviUHVXNgX/YYYE9E5BgKznZPPEeMZgYzU5aLGEdyn1a8AdrH o/zI7eCjdyiRrWHcNeVr+4CjBz+c0WEbC2teXwO784BaLcBJ6Rr7E4vGnglsDRAR 9xxv70TLGnrb6macYiZGqLnSFPQNCuGRK2UQtWydIPU9TTZ9ZIunt7QvQgDQEdaf CjMNSQiwgskV1neAu5seKMsTqTtQeGbMHJnamST5Hydo+f5/QNkZGTNveNKRnGV9 VHqu/m9SudDmrF/mOWmFgtn2Ax3fyAxz5flMEKKIAlkfW81hf2t7DqYH1AeXz9sk XwoRrUn8Nq78D+5U+LjP5H98Ngqg8DAqmoh+/JgKX0Si9+QBH18cr7F4ynAMZnrB d5scdOihIwpsXICYwoACoo+SLKz7+T9khp2laCZkUw+pdhzQ3g2DhHbNy8+tA7Fr ewWy3VFG0KW0RdjnPJ4kQtaEj+noBa8fCUMe3SA/YCXeEti7IN4o0Gxacle+7LIg xSKWtUwg2FQmEzdc8Grwc/SqAW32EkPT+FS82G4z1s6NhSoKlVwgOpAIi1j9Z375 boomlVtK5pwhUkNbmThxlyOr8jz7YaX60FZg9PWehFO7AgKRXDcjekjmrPVNIe+t OMUaLHQWoMArE0urkqjflZEZji1AtW6GTDf1DDi+fV0ygQJMXIDT7N3AI7zs+hvs f+kWW9+gUmQ/02d5F7NSfSdvXtIYv4l7IcgrL3ztQAqMIXPN7T7netmbovQaRSZ/ Ki3H0MBopiOCLyDE9cgE6zRdxpRhIaiV80Pj/g9OmZlQjOixGWPG3wWTYlC4O6nV uimTdzaIRP8dqG7AKgYwhWeH8t6xrGnQu3ocEhc3GLBw0l6ca9DvGbW0mNbJb6ei zG/XECA+Ib6cg+T9Jie0XFwloahkP3VsCXlOWlZUFGdGqbqeFRL50gIOMClwt5T4 TUwTb4Z8kH60lmF0JBWBj/Xq5EzmeWjx06W1Zst1TkjuZTh8NAAeFrebTSJQ2AZh gevL2BoI/9rTsJ7yDNHj28gxSXnRT0W5iCNY+wlT1jbMcMkZdbdMUK53plRYIICU ICsmOgSTLaHu2UL1uwC2fWICpR/fBe52eygtJkXq1mqR0mMCGmeHLQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0F2C8840A1F62CF1

http://decryptor.cc/0F2C8840A1F62CF1

Extracted

Path

C:\Recovery\9cfw9k82-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 9cfw9k82. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D9FFE09A38E1DBA 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5D9FFE09A38E1DBA Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: F4QKEFxZX3EXic1j9KY7Imk1ZL7HLI2DTc07in39hfkHpYqpVCa1k7aQB8KrPuRa A15z72vt8y1Nh8uuGT5C2Ixuia2LBpA8O4G1RkKPQgeTJOOZy/p5Eg++7NKioLRY 5GloC5n7teEp80DePdo/qzy3ZbW+LdnN9uYtH/a8OemHBgu+N3cvhlohnLwwFfJJ ASt0KUpGZsOQzSXVMMEK49eyfY7CZ+Z4pbxCvD23l4x1pE/6Gv8FSOAInOFZP43L 4sI31e8iNm6ijUCGQSuoEHfCKlk80XH1f0oV94s0IC8wmAx5OFmhmnoNwsTzGOSj 4NpMBaHb18oenBv3Kf4mSfgoKTsUiQB4UX+w/Hv21m9bed8+76z1sinEnA07mwcF 66MJ38bpP+p52a5BJHrHVvYrwvvYKd3NPt7ZACcoypznYHp8dsfLfYNlqtCO9vxE 7gFAufda4TZryAX1Zy8CiRabJexYQdhXLaj9m0Q8KMpL29vBUIbgx2ZhbVU9OsVa TioQbLm6grV83l+dF1lhLZptd7X3BillkeMnlRPCFrsLQcFdB901wPYJyREnrjKm Tiux5yb4pKknLSA0k3z/YxVnzXqdSABC3jDN3NQyk7vhyX3vrQnXEP9NENHyX54s vEQIUvizpN2+KhPPpEE+saE0qcR+AlJeT8pTHbbAl7T/sXeguyoUuNgjrValMlgP K6woZPXIRAEUxYddHAqt7Sj5k1wcr8SZzMQS3a6tY6WCPii2x8waCfBf88dCHiL/ crvPxf0Yu4YnwxXTj7gmNFe61/Hqt7Z4/lOoTTtjDAf04OsTWQH4nCw10uiN1AAB 08WJDYBtJGEaqm82/oNgV4GXn5MYapNU4FIwpwdqsH26KwXuhkrI7M95ZzwtYypb oW/XyNKyqXSbnPWY1yOjaSn/rOwQLpdEby02Gw2fZsibmpuR1/HL0cfjQWWbImVS FLo67qggnHKEk06iKZRxpSE9yarCiJREvX4GP0zK+fik5xBG+tvAkxP+9Uhi9rhN XAiPLCi5/ceybhSDTSA61wVheHrLJsK4pdLxsjZPxgERWsM+ks/bRM2zSlpXeKAO Rt1Za1zHPVZY1CVP49vW25SNyI7Wra5BkDOsRW6qhz8UAD1zIuMi/eqFoEqCsUm2 AT9ab1ADYbWdvDyV7JReZ3ZtmaZCwwDr5tzqyRNQHHrSTnVrvcjBYJRvHpRMjHQn NZRl09KWGLg0N97SzpDjlJvHEecyBlZ24UmM+5pNtAk4XKlBCJID+TmTPw9JFlC3 rWECSjegrA27CLniEORWfTYpziGaQY3MoEdrDIOuw8NNWn+7cjEwgDIhOWJ31tdN LjhWvZlXJxvkgdTrjOtVYtIT1VmpPpjlaZBTrA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5D9FFE09A38E1DBA

http://decryptor.cc/5D9FFE09A38E1DBA

Extracted

Path

C:\Recovery\5096oaz7g-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5096oaz7g. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US (USE TOR BROWSER TO VIEW) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/125?s=7ee0235fc7f67403393ad971dea5809e [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F9647201020B5202 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F9647201020B5202 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Ck1WfWwYd2Jo7SjX2GkCBc/PlfBOZRwskJFd1NHpIBo3c28cNWsVrIYnf+IgeCqF iPWs5SFOwg8iphU80wIfYnFDehXJnOyN56Hd7eoliU1UYdMK14rFuAaoilOmNi3N +gSz6BdD5CcKjkQkcM+qX7vE6BhxE6Ltznj3D7UtPkVaifACUpgCZz44K0p6c8OI P4ZtVOeMOGhCeTL4NPJUe6ucjFQMoXdpZtuA4Wn04ZLOZy6vnPTDmQknj9QMP9uG 4jMGurnfFVh9VLyD7zLL/jmOH8sUZKS4M5rj5Gh6tFvH5iiIEuOiIxrkjx164/Ty BoKYt1eewTxO+fh92Jh2BJdXN/a91Vlv7hIBwI2DKdNVLVefDzl7OKObFULfRvMj wpUPoUKLW/DYT6kUdDCMLor8smWDz961YoH90/jefXWs/6fcXQ7jDa/4BoS3WjBT 6xHYQezq5IVicaGV1LRW7VzEKOqx24FcRGhOgIy3lUthndGuC02nmKsAg2utBUjC CGjNdsDHClM6MD/QEicOJsK66VWoh2fqRyqUSoGJVP9kRkm3jOI7eFAHZMTxf971 k7GHDOJ5RuawpQXI4Ao+pggRbNDbj4cklmnuW+OeEQzYLP0o3nRcVp36MQILvneZ 3rYDb5IM+Zy899yxea7rXyV84xunn1GP6olBjN4nwP5Ot6r+RNQ15ptYtYzOJztg TJePtN0whz2ZWtkgn6XlUfiBn8mGSsud6eTjN30twvYap78p8AI5+FtR2ft9XFzv zfBQrgmfAXy0qz5D9rBxE7WnLalLB42I6v2yGs6p9D1/jqQ8XldgCG3+u93OgmTl lyUA/QEEySps9dV63QsBqbCMuWYYidEWj1ibI7eFpbBMTTIHu8rZqhkLR4qLxFHa 6+2RTOtgwOFz6l58diqFomg/oFfyGsZCB0xaHjn9FgWk6R/eb1NbBPS0WlT4Fnmh lly4AHhKZ5nOMfkV7kzBvcbZ3pMpYX/pnWRoLYW9djot1oI4EkcXXflosWC0ka7M /aNej+Blen+aVFn3etotUDImF3kmPtrUTyN9UG3uqIZwY3Az8R1rzCxK5gFEaL8t wYqrdbpysnxloAYY8ABcMg+ppQj2MiBGeXXlTEsE7y6WQqVHuNb4HZjwZsRmMm/i HDnZu3ZN0Ci482QpwpUkfR1jKZdoyoUw43AqvImIUOtIJDYECIGhpVoz6Jjg4lSD tC0wPALXKXZ8smcoqQprrb/Sz0V79XEAaMLL/K3IxtqJfCYKsiQfA5vY1+WY5ANh TlY35UPwP4tlZNHyHFzW3nFAQ5M7pRMzQf0g0gktMYw5xLzFpc1FUsBX505+FrWW tKgBpu4tzpFA9ri9lNyUj+8/scTWsaEzVRxGs9YiOxW/39NPhb1BMhHqSA4= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F9647201020B5202

http://decryptor.cc/F9647201020B5202

Targets

    • Target

      adb.vbs.txt

    • Size

      116KB

    • MD5

      b86ad4241b01376b3924a380f6f4c934

    • SHA1

      10682d08a18715a79ee23b58fdb6ee44c4e28c61

    • SHA256

      14c8e3f1f23d16c2c9a4272cd05d00461d27b372cc5f588b4bbfc6102bbed708

    • SHA512

      54fd19cfc37255e7ddf3456d1a2989558522cf58e5eee6ca916c19542921fe3ba4e7a431a35e0e1edbfc37c5651d392e7c3c54eb408754c0488021b16fdf92c9

    • SSDEEP

      1536:aTZINbRh0SKws6KTUkmHlntMvfWhbpfCqeICS4AKvQIFlswOmZFS0cnwpIGmQwB:FRix3PWhNlOVFmw5q0cifmQ

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks