General

  • Target

    42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d.exe

  • Size

    166KB

  • Sample

    231116-3rp2aabg75

  • MD5

    43e9093ffc8dd69985a9ae65b26f5551

  • SHA1

    7b268ff84e824ddcd8b7df3cf9993be012489d01

  • SHA256

    42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d

  • SHA512

    118d879750d0456f5b2e31818815ef9465fb40eac24f4784236c626d2a2e753b5a85ec5b2c66a755b10855c9caaf77bd85b6b3d1fc7003fb029cb703ead9037c

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QG9BEJfMt0H:ZJ0BXScFy2RsQJ8zgG9jt0

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

3134

Decoy

mank.de

work2live.de

triggi.de

innote.fi

iwelt.de

mdacares.com

celularity.com

wychowanieprzedszkolne.pl

bildungsunderlebnis.haus

urmasiimariiuniri.ro

devlaur.com

philippedebroca.com

kaminscy.com

boompinoy.com

webcodingstudio.com

onlybacklink.com

victoriousfestival.co.uk

levdittliv.se

rosavalamedahr.com

DupontSellsHomes.com

Attributes
  • net

    true

  • pid

    19

  • prc

    visio

    ocautoupds

    synctime

    dbeng50

    infopath

    tbirdconfig

    oracle

    winword

    firefox

    dbsnmp

    mydesktopservice

    msaccess

    xfssvccon

    sqbcoreservice

    mydesktopqos

    sql

    onenote

    outlook

    ocomm

    steam

    excel

    ocssd

    thebat

    agntsvc

    powerpnt

    thunderbird

    mspub

    isqlplussvc

    encsvc

    wordpad

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3134

  • svc

    vss

    sophos

    mepocs

    veeam

    sql

    backup

    svc$

    memtas

Extracted

Path

C:\Users\5blvy91ar-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5blvy91ar. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DAD4B9094BC94B72 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DAD4B9094BC94B72 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: zFIg9ZFpdwNowTQb9JxMde3BLDkJoYfN/pioHOa3pZN37YwjtmuSoCUz8i/MIaOc O7pb6smNqgys0mkDdL0SldkZtjJgn36e05MVnC7cP9+NKvGINXR5jO8zCU8DoWzI D/XzfE93ISoRjDahCa+9g62+ycLPEATfbhTQ2tVHCP58S+928aUqBxYMFElIr/6Z npbqAH37s1qsV5jnL7/+IfbBacz+B42T8Nz9MSLSuJlwYmAiUqnLfIL4eDUYXLzg w9ra0zDgfRyZNhQfCt0rSTD8gLg/DqkCY7wxwtZtBiZpwJ9BYTSV42uU+6rBzYwo 4Eth9lXfFFlNtbRodXjFr4xTG0XevCohC9WyKTlXLRHz8vE2KaB9ApvrdjmXp8+k xZQ63Osidn4LcTlafA3BmPCl9LmZDg8m2MpZ10cNfeHrUy90bpi4y3ZQlmaSSzBO AB8ORki0jx9g5cbb8BlhZp4qNQSWwCCkZkqRW+vd1K8zFAgj0g6T3XuLlP4EizKZ iExDPIGdGMz+dQ46RYRUT2g584D+0Hbmx/SpeheDU8yvrwa6Yo7Poye1vi7EruaF MDUgboCkiw+3RXm8uivFDt1Jntv1FGB53yHc+42NH2M61RI+P8IVdIt6aN6rcdTy MwXuJ3+r9L3QyWCejMLR0sQr0/OtdIJ+hxMqnKjCIbBPeGW7+c9OYrbyLb6k3izj dzqwNjAAGQkeST33YwCE8HDwhh+V1Tvf3D+kPRGEJYB6yoPvH6wzlNDJAXP09/2N 0DROLzwR+EYW1bAeJgb069IBAdV+xmlVViAoZiya/JoT7lbqnfe8iNRO8xryWGFB RWu+8nQasdDdcQFexQv09Al25Xrbhxl1v8SCGAQTI1B+BH/I1AUBHRtF4L3dgrQ+ oWKMemLwVZ2JBnTqNd7L0DEiy3jZf36twI7U+dXf1pShTf+Hqga6Q7dmmwrC1GUe AJj67l5B86/rzo61jvm66yrJON0XK4+kGmIlV3Co5Hg6/e1Ah+NSUicszOgVC8zA XrpgE3Zgbr4btGB4n3m+4QgrpbKz5/cLfHq0+coVrwq+DeI0JIrE2WNM+J0n38XC gE5AsJ3WeA9rP2HiLMZaLNV7vgCFlINwuTPl5h6sYErfqu96eDvwxuyG8mIGaz/g b4gUnSkblZ/8QVrUg8ykGRR45FS86UZDKiZvP3kat8gUuq+n5zZ8nEoDNLUGTh/K nLZEHep3eBWG7sa1e2VYnrZh ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DAD4B9094BC94B72

http://decryptor.cc/DAD4B9094BC94B72

Extracted

Path

C:\Recovery\0s13n71-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0s13n71. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/25B043A3BD7B3100 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/25B043A3BD7B3100 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ZzUnvuaqVNTX726W/hbAgs3KTVCEM7UpLGM9UHEEv0T7+4eRR8f+CpSb+d3xhAnK 4lagiRLKQxf1QsIs5ZhUN2VDAyUv90eISgfcrA604P+bTk2lqexY64OyO8bSNBb3 BhB+CcxMGsIxPcu+b+0Eq4JbxaNcY+Jkj5k2SisGAJbiP8lk0Wv1Mfx1q+iGAbhG OrnZPecVzqjuWb6+6QQG6DrhCcqe3LolrudwdCE0DvLnXv3bnmE//TJDiLI0s9+i 1qi7Xx5RGA/dom/rwC/KnTPzZVzwTMVaf64MNHyVX3gpZUAsHVO8ZpBQXmkzKFZZ vXcadTBQ9WtQYi4soxuWdTqu/kFlfJ/8w3wmT4wkXrOoUrRuVerez0hK1aKNknIK OLKi2mpBTXwkU+KqPn9sBi7ahOjrLEoUdMmWWOvYBqaAQu5KzOQqKyTXIn150fKO NeaT3hCJctWqzszJ7kmQg76UQu8DfLlLs0LdzVZM2Z7kzAGp57G4W61c+yU31EmH tfF3HC4zNj/c6NAp6BJyAapS3aCTebxPDKUvtDRPaxeOSg1x935epFL88ZLkMpoF Des9DAvnGedwTkWX9lSbxzI0hTObmqBMK7hL3KxKaOiuDuXbIJiTklVdLVXEHC2k 7c+0cno+aDB2LNxIG3WpCY7njZYuD26ydRNDVywt9autFxhGn4d88/ZR5Di2Ps/3 IloYdV9Mdy2w/9bVu/H+E/hETQ3c0wnHbm7kK2MKzRwdlDddXPhT2qtuVhzBmSFR glRrXtiegqeymYF82hy3Nf3nmCmYJTTPPzaq/l+ZlOdBo6iRaXTDQTz/fTX2OKk+ Sn3jR7vhaeBkKAJZpFrIFJv517CTVdka0kDMvgzS9grmaCvPAwk56GVx9ZnjWHT0 bNIEyuYVySaFmEtx+Ui6jfdeetraye+Is8EGOqrXYk5yvvjPLv+ghwNaWEdFF1CE shB+4Cro1/mrwAQbBycdwUypS4cBprM/o5Fel3ObwiKWwdQxnLYIR711MHq9bFZ7 lBF/4zfXXxW+SC8WZMnQQd9P6Dq04mfnZ584QcqdeehRqxAAqCRrxRsmdLHwHhsV iQSdnuVuKEvMRp9NTuZ3bRdj14h00mdxFXG8p2T2+IFkwgxT29wQ0LS3KCYweMGZ BpH8jDPy8hnEGhf88cvEOb4oJ+AfyLxH+QWz0Xsx1sQJkLs2BwT5alplsQ25DOY+ Cgd4zZf4OlcB76KCHfy0jtWDvSw= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/25B043A3BD7B3100

http://decryptor.cc/25B043A3BD7B3100

Targets

    • Target

      42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d.exe

    • Size

      166KB

    • MD5

      43e9093ffc8dd69985a9ae65b26f5551

    • SHA1

      7b268ff84e824ddcd8b7df3cf9993be012489d01

    • SHA256

      42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d

    • SHA512

      118d879750d0456f5b2e31818815ef9465fb40eac24f4784236c626d2a2e753b5a85ec5b2c66a755b10855c9caaf77bd85b6b3d1fc7003fb029cb703ead9037c

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QG9BEJfMt0H:ZJ0BXScFy2RsQJ8zgG9jt0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks