General

  • Target

    15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

  • Size

    160KB

  • Sample

    230813-k5y71acc4z

  • MD5

    b572a0486274ee9c0ba816c1b91b87c7

  • SHA1

    43a904323a8583203b307c622c71c8ca706c2462

  • SHA256

    15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b

  • SHA512

    77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171

  • SSDEEP

    3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg

Malware Config

Extracted

Family

sodinokibi

Botnet

15

Campaign

19

Decoy

augen-praxisklinik-rostock.de

pokemonturkiye.com

mindsparkescape.com

relevantonline.eu

kdbrh.com

ahgarage.com

rarefoods.ro

lollachiro.com

drvoip.com

rino-gmbh.com

powershell.su

eyedoctordallas.com

riffenmattgarage.ch

signamedia.de

ocduiblog.com

kellengatton.com

salonlamar.nl

nourella.com

birthplacemag.com

2020hindsight.info

Attributes
  • net

    true

  • pid

    15

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    19

Extracted

Path

C:\Recovery\93menjskj8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 93menjskj8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE5898E3DF8D088C 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/DE5898E3DF8D088C Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: x2A01CzCTvygb/wjPC1ISyNZJuwkmKJlgqtoyaeIcK37uA0tZarju0uvUccAWo7g krXQe2/EOpZWSze8vnxzfFzTZJc+aevgDbTieYAMfse8YLJRVezuOBn1sTKBE0BR WHbD1dj9T/k9Q1JMun8NOxBsuFqKezbFAup/DkLI8MDk5duj2ortghRf1O5H6nN3 o0x7A8EZsmaf7qUpWPJyrttgvcVFqlCUMo9Fd/S59MrtIT4kl1GcVSH9wYGctPZQ ThNrMFL28fe0aZu2lnkwTzgoDqvX6D6hzIWpJ9t1DXEJFBlHMxxCmLtRM0Pe5OcB 4PrjgwjdytfI6+1+lSCWru/xc39UJ/OuML2th88EPzV2YDVj+5VjoXFOOQIW2Pmh df/jfuFksb2t77/EJtgDDSH/xr8UlqdlpFLr34VLJTeuS5Kre7HMw6JyP1KUZcrm lULgTqJv2NPtJ2EKtKUrIernCF87mp5L57dTfsZxhd7vzpDIT3/WgcvU9o61129h K0aA3EemITP/Lfl1jqqynm5ihWR8vb45zNQ3uUB8Lju30wvScjZsFezzfzXuTnif h0y3tzZNWwvEdmPXDY5RBjp8sCCxzu+qFgPtX2qaNiikqyo3ROlkEtXsXO9nlYus uumLQkjpPDwvpdEnRYr7JsBYEKGRxbHRR2PoVVhQoeJi0AvBNHZexWJjLKTLjcLx w0GP7n8dafsJrEJSXvg4leZGb+19pLU2+T1ezmrKArG3lgq1cS6ZIsKxwCxFwu4I He8fenUXwDKSiR50Xs7ZRYX6wtwp3XBx/LA4m8GDUjXV1I3j627DyA4i6W+01IoY +5PqKCC4WIrf4EHSbzL8zIP2GVGgwK3/vMRoxTOCsV/zGJUs24ZWrO+WtkyP2/6B joLaHRUm5CKX1D3GZ8K+tXRM0Hb3quZrVMhYw8VvTg9F0aTR3crmPsdOKKJakLbg o1fe7MJujEanF51UAMpWbt5cn88Grs4xmjoBKY4/r6FGGJ5Mhq5Z4h6U9Nxq0G8U DER54XfUvn4k2jZ0m2P6ENNXCRSs/oH2YcxLVTeOYLzF+6ocD1wVYnm5h0rJPp6N TXw8c4PTEzhoikqS5afd4dwU/LIKAugPMkJs+JH7VcVoxp/2kYX3H6pWRAc01WJ7 9vskJddRQJ2zD5y9hFiIkPYVVAc4+ePqvgdZFMd6ce6lMm8rbPXu6RlkNyyihSaa lU7xPGP7wOcdYJVEOLuoLQ== Extension name: 93menjskj8 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DE5898E3DF8D088C

http://decryptor.top/DE5898E3DF8D088C

Extracted

Path

C:\ProgramData\1ogzdt-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 1ogzdt. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/483F7F5F49E3BAD3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/483F7F5F49E3BAD3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8yCxvrUElyo0jZtdpfPFvGqAZvPD/RI3Jxn3ujVUO1WB/aXbZQEYUBumU0dcNtaE sSbwRhXfpz4W4qWih64ECAoHB7F/ZyqynT2Csq1jqR7wVpOp2rNLjOXTo/DH42Rg IX0SaPo7Mrig0+fCg28DPHi2xYkQhD3D7lTn4NvsZbi/OrBv7l2tVENXUVbSpTq3 nX+igFqlynNWO9wVINFhAIXyIf9+zqhG2U2C6iAJkpvQ59x8arSEQNzvtEr9xfOy 1pQ7U9ixVy46Ha6/g4fEQhTzv+IJPo/Pg9cTMY/8iMBJeHl5veTZ6Hgl5DxFNpUv iAfSvv7yK0xlLK0NTo+gpSbrlK6Q37dbB6xPKnp2L7FNocc+Aul/T1ksewjopInG jx3jRW/VIXVr2ZRzDOqmWK+ddJXo7sckzmF/+RCe98mt+c43m1pdaWWzVBt0wZCl jtJOtXBCDT3R1D/l7FkDi/TejmlGNVwlsjBZLNAApe0YIrk7ZiXkkIlvTTCFqVIY meMlsb2I5IKx1Y35/oG7WSNiGHC24XMcrEKy1Z8K+mI1hiPE9HWZznVlnUomMXLN XHeWtMPDouP9ZQBHplX7V2nsVVcW1bPBK/2sF0924/UwILWxiTSj4MKBpZx4dVnl Jvrc7SI+wMLO7ycZO4oZMvADfs1v87Bb6z3/8z7YJ1xgsalTAE/qNqqT03kpEwhm R82BpAu9EthUUpDEHmudTQHZLgzD3IeB4lNeT23mJN7UVlL4FjgWKCTnc8G6hhAO JXVm/jbei/1ToB3k9+JiXHvYiNSZLuG4op/LnT+xUYO/peWfsTKUGGEr9Kyd/hcP 3uTDu1tfj4Mjf7xQ0nFxqKeYhHtPcZIxXkHHU6uTtyirU3L0y6VUE3nzoYApzZCD O0hB7yTVEumIw8bVuOLAN+Mt0eOLIYD4Ol/+5LWEGgdGVglphb2mIEp9PVhYz2QE 70cQgDCeftgqZKQC7LR8q4cm4UrPTK+PF995Ql7j07QPXDyyJ5fviHZinq9ABO9d +Py+wChBjHV/FHZaAsbx0BayruYkBSKxMmLFvuTQ+8N6SRkE2poMbGBd3/BNEb0R 4xCasH8QVUPYQ0xbJRve+qhMHqL/X3PzwuD5HTfY8D1SiiXImXzJ6x/vzVv9Z78f IVJ3tBMZrzRluvMnc84EIptU/5N4jqBFGCglMb9x6lpGhQH15h6N3K1QM9KaCKnN xBm8CUVssavwVamdvaA= Extension name: 1ogzdt ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/483F7F5F49E3BAD3

http://decryptor.top/483F7F5F49E3BAD3

Targets

    • Target

      15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07bexeexe_JC.exe

    • Size

      160KB

    • MD5

      b572a0486274ee9c0ba816c1b91b87c7

    • SHA1

      43a904323a8583203b307c622c71c8ca706c2462

    • SHA256

      15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b

    • SHA512

      77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171

    • SSDEEP

      3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks