General

  • Target

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe

  • Size

    166KB

  • Sample

    231116-3svcdsda3v

  • MD5

    340b6f816bfdcfcb466cfc126c976844

  • SHA1

    e2e3adfcf621166a9f5bb7ee9795b7914cda2095

  • SHA256

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

  • SHA512

    3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$maSqYzCs2s.gezYwrFOoJuI4SIRqDq0fr0z6iKBeb4EdgQpwYnYjq

Campaign

3385

Decoy

balticdermatology.lt

liveottelut.com

michaelsmeriglioracing.com

spsshomeworkhelp.com

campus2day.de

madinblack.com

tanciu.com

agence-referencement-naturel-geneve.net

jakekozmor.com

tinkoff-mobayl.ru

myhealth.net.au

maasreusel.nl

pmc-services.de

evergreen-fishing.com

noskierrenteria.com

galleryartfair.com

importardechina.info

trapiantofue.it

tux-espacios.com

ecoledansemulhouse.fr

Attributes
  • net

    true

  • pid

    $2a$10$maSqYzCs2s.gezYwrFOoJuI4SIRqDq0fr0z6iKBeb4EdgQpwYnYjq

  • prc

    thunderbird

    thebat

    msaccess

    mydesktopqos

    ocomm

    ocautoupds

    outlook

    xfssvccon

    wordpad

    encsvc

    excel

    agntsvc

    sql

    winword

    isqlplussvc

    powerpnt

    ocssd

    dbeng50

    synctime

    visio

    sqbcoreservice

    mspub

    tbirdconfig

    steam

    dbsnmp

    onenote

    oracle

    firefox

    infopath

    mydesktopservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3385

  • svc

    veeam

    backup

    vss

    sql

    memtas

    svc$

    mepocs

    sophos

Extracted

Path

C:\Users\0z7n2j60-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0z7n2j60. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/13D8967FBF9D59A3 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/13D8967FBF9D59A3 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: nD4+95WMH0YEcXqo0pdFUUeTrhwicGsqQS3bWFXWXpNL6mJS3hJRVjUX2S7IFkL6 pGF57iVUcurkn65In9pbZviCquJgJwC5kMKMwefnmhvjNUawNF1Wyt7NVlqO1ZGu ojAh+oRzIBlDkqSFoe3/rMcCPBAEZ/oR5cLmHElDVv5QHbW1Ec2BIdJaE0xe5dJN pZsXDZLfTVVdt081N1VhEvlwHhsR24pMEsM9wkiq4W5hg3yV/ho7iXLTv4+Hk97M GmWXIH2sZQ1hlqDg6T9Wxspyk5q6hrtwgrXs5jgi6ZOZj7OkLclK56cg40DXfUCT lmOy0sqMSvS0KR8eKnwmpJ8obJxl1jv2vrZLYd9B8WHu6WO2sMp0iCM9CWq8+YEM +E+jPdgaUlzS1B46HIlCVqnoh9s6Un/lIgP7Ueg/zlMmkhPsZhGtKuhFdWGpCjSg Cuss/ojDQF2Hl3zJWS3IGamA/+MUTyDInx4OgB+szYYZBJeQ3Cst6vcQptaDFMwv hFj0GgNicp9PKii+UeBWKeuvQsfJ4DCq8Vm1CoA83pm3HSk9NZM1rjTx/izAEdL8 uGlgCOO1iRe6tt6uFyIdTqh56jflUyxV72k9+ZHcrqsEgo9qbwye/pHTRM1qv5RF EjOmbKoLtsoyqH0gnVVTdmmcTPsPZGYbRzmO+ZIViNF2z92tVPEBm9SiALgKwpfx jtwf1jiRkyFr7XHlcpBK8OC7t0o6unew6uCezf74czaB5J5qS5gAVZsmJZ0PRtfa Id+Prmv/rMEbQvm4/tNJjW98vNc5Olzn3Pj1ucGj1VAd6H9TkQfPqXE++nuYFl0W f7V/RGrflYrS6z2Jpi4/1dHjIL7IwpDYC2e+NywtCbOKr+AH6GPMXM21kB6QbXnv gI39fP0Cd9uv53DP2LBicsCoFi+uGF6SMD3o/zPgt56fzSM9cc0xngMwS4Rp3S+W QkGdSKj9xtonc5z5Y3dlgTVO5yoS2qVRMF3exkKNIbKihK+Z3FlQE4Axo5NAjaCS Bw1DykspPnHaHYKuFCRB/rN+DkrkFiMrfR08zuoInOQq5z5dOzUWkjc/vl2/z4Xs rFr/M29nw8dMMSJukq/VYSYQoYCBlVS4W8jyMLEfCBFtgxLnBj5YM6YL5uls9AFG pt7Mi1VVRBj1b5CF23qRTMTBe6cIIMPYaI/0Om7nbPDheBk14/9fQTrEgzJziR3E 2W3xYL3MihyPxtT3tCm3IZY6PwjG9Fo29qDH30fhZh55kBSxVSch0ehUf8Bc7kgD NFjUSzcd3dq8kJVIlx9ZZLg+6+2HaXIFNaE2Auph2LgJM2a3++lePEWEuBhYgMBi xuS5YPGdW4h3hju0jCGgNhDSh0xQo5ppauZxWauWnfWjZ/pF ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/13D8967FBF9D59A3

http://decryptor.cc/13D8967FBF9D59A3

Extracted

Path

C:\Users\0qmor9c1e9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0qmor9c1e9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AF8BC69A8BC54800 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/AF8BC69A8BC54800 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: juYpYrNB1reOS9vNmV9vyAP7oUKFy62xF3J6byjZJlMJHiE/MYkA/ZtkYwhQMhm0 owBATRqVJOIgt04Jfv/kbsNTlfOsRle5ImynVdD2D5n350Y+hab1nX7Bhrrozryv QMsf9oUEc/uLwZh2sPYjOioHC0DhMsKiXQGscTjNJlOPl6r7p8H3aMRlmSF6AZ42 fetUMi/Nlq37fkAn5pHv7QxSVbGA/6MPFIIMOPLmI988w2qTQICZ/vgAVwRMfAUs uN5BITnb3moPDo9Mcjx2VbRumVB4iQsHqFutMjLX5ASijz/I+ZwlLOIfKzGkV2L5 nuJv1bMHxfmm/BZixNqCxD+MOEbObMWd1ItjDgghSIHydfht+55/WlGLIQNgPflJ s2/nGXoUni12WX3n6hgPO+uxf+kf16nVPQi2SPBQfVoWqJyECX/aixD4lUhdfqH6 ZC8qPL2Qz32zRY9OA6i7p45pJVGksNdbixPvfU3Ed4HkcnhSnYyeYTLLFS/mvMkk 9EaGL02oIrGnCIKbbubfSBmCKr07dgCCZBui3zCT7LSRprCDDVlWoLqvqEashC0S HehCFHO7bsBjKrTqVeuf37oVAH/HCtl5DEvwyBhwJQaOFo0EwAFfJxJXsRb+Q4PH 8hi9Yh6Ywc+bIBm+TTNsUwPVp9MMfsWiY3ssDt4xG/5vJLJGOcUuc1GKA0moOwfV j0vBWZ+bP8u8JTxHm3Iro5kGBmHJ5dV+PiITh2tsA8HppM6mGfoEnOgELX1fvHD5 YvZHOg5Msjz7A3XeHTs5C9wrM75L/l9nRiahwlb2BcIrimTFbNFrqd+YBEb+LfhQ j4xSHx6/H21LJ8AQZE8N4Kv4HOp79U8jf5+Gbb7Lt7gFUzjNYd/wLitBXRpr/ums IbdSyBR/nnbA+39LZQk07bPXQqETIZlXfSN/zlWmID8lhzEhUNgN9foC6WpRrElh 7KtLNoGYenonhxFhmHj1L/0GjKZznM6MaYnNrCVY+3gafbSchX0eJ8/+fCNaFrO8 Uo5LuuSSsOVJjBf8HQWQKSKMrGnJCEybdR/4fn7Bv5uJVwelISN+nGYp/j5CuEoE 4rrdZO9gJjbssQQU80XP2JVbNwy7aAJ0cD8iaq1U76Xr5G0KW/y8eBIo/2kgaHHr YtpG6wA9oCqXIOQS98xq3E0wqnw41a5XX2eB10dMDPqXtp44Ve/5nATe3vW092U0 FhzRYMvRlufZA2G/BGjdVJUnigL8CLCrz6Ycs5ndQFovuxRpMz/h3VHCcykwRpr5 HoFItIo31MUBjDq2PVk7qE7AZvQcWKszVotXWvjl/oqzEz1b4PMyMoam/qdkH2VD Cxgz32L9nV2I24hqdXMOkEjokGlYpcHY4X0OdZ337OC0M99rv6YSKgcz3DQ+bw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/AF8BC69A8BC54800

http://decryptor.cc/AF8BC69A8BC54800

Targets

    • Target

      3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe

    • Size

      166KB

    • MD5

      340b6f816bfdcfcb466cfc126c976844

    • SHA1

      e2e3adfcf621166a9f5bb7ee9795b7914cda2095

    • SHA256

      3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

    • SHA512

      3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks