General

  • Target

    NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe

  • Size

    166KB

  • Sample

    231117-vw74nabf69

  • MD5

    44c753ed1faec948b0d98bc9ba047469

  • SHA1

    1aa2d575752dcfa73ea8bd2fa666e18588be353c

  • SHA256

    6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01

  • SHA512

    f7d4c3988f82839264e83c1a17024c695bd8ff31a224eba3cfc9e3712758be5450521c1e52c246b02dad0849bdf381ad40d77e9b5bab6f8135f07219c13047e0

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QoIeXt5KCn16:ZJ0BXScFy2RsQJ8zg9edTn1

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$fva76xkUX4MoDJONImPZ/OtsZkdWOv42SsOrVCPbhHubkM1Qg6S0i

Campaign

467

Decoy

hoteledenpadova.it

thedad.com

creamery201.com

songunceliptv.com

icpcnj.org

ogdenvision.com

craigvalentineacademy.com

bockamp.com

naswrrg.org

pelorus.group

fotoideaymedia.es

wurmpower.at

gaiam.nl

wasmachtmeinfonds.at

pasvenska.se

jeanlouissibomana.com

kaotikkustomz.com

id-et-d.fr

kevinjodea.com

bestbet.com

Attributes
  • net

    false

  • pid

    $2a$10$fva76xkUX4MoDJONImPZ/OtsZkdWOv42SsOrVCPbhHubkM1Qg6S0i

  • prc

    isqlplussvc

    msftesql

    firefoxconfig

    mysqld

    sqlbrowser

    ocomm

    thunderbird

    infopath

    mspub

    outlook

    sqbcoreservice

    encsvc

    tbirdconfig

    onenote

    mydesktopservice

    oracle

    xfssvccon

    ocautoupds

    sqlservr

    powerpnt

    wordpad

    agntsvc

    steam

    thebat

    dbeng50

    mydesktopqos

    synctime

    mysqld_opt

    thebat64

    sqlwriter

    mysqld_nt

    dbsnmp

    winword

    excel

    msaccess

    ocssd

    visio

    sqlagent

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    467

  • svc

    backup

    sql

    mepocs

    veeam

    memtas

    sophos

    svc$

    vss

Extracted

Path

C:\Users\a89wii2p5s-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion a89wii2p5s. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE1FF25BA7C81F84 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/CE1FF25BA7C81F84 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 0aL/Qtxuu5gPFaKH9/3KvtsZwmtbcDXg3fDoUA7j8/vPyR2nZgMUYcni3Pl9rR0M 1Db9NwhWySsevLI+oqgcXSrIsMTizwI7BNeb3RF5EmrGcn2d/wOEy8En4BOAmmA6 tz6XmLQ/fL8YF+vAyOQKmfG6weQv2CZssCwYGBx2W5yn3k5RsM+ZjKZzIB2cicN7 OMgIzR+E3xscPPpmvi4Pujlqph1qjQKBPSRnLb51KSdKUo8Sxx3SeprI5fuXmI4P 8T3A5y5PWcU3nwCVb8+aIQVgdqoBNSO/xOeTnKGHyFH4AVmkrh+ftVGFVW8Rwivh e+LJPo9paZ08jjNUcEf2nVDXMnDReS3Mx0NCSVUwMFMGMMZAWn2ApH+lkenfZoEs sS4yuOMOzCWg0hXTG3fwkqxtrl2umrj3jjj9WO+7zFE3cs6ssGKkc8DRt2eXbu8B 8B3kupsFP1+OJXEP5g7YAS0LySt6kTrq2xFZmkGg7eam1nTkUtwliMrxjku+INaj p9J081iPsKuETNJq9P065epFA7iUAZtlO2OUNL5jW6hUPe/Pppxzev9sKMVanpHC wkEwBBlNxO1QzNDGsmtmt37err9GE8BdtrmKarSeSg1Smn9gyHDiENcvXLTp80oe 7MzS191nppYr98gHcpCeKhYiCaSOT2cllBoLhYxEb6xmPTEND8GLvrFwQIV8noy5 4wROgni+tR/7pehzKN9nzj6H3ZHZ8Qjxm9FAqdzTpNhjDj+yR/sGXLwRr5V4jL8v HU02zsymTViUt2isrXuChKlW0gA/zKp7uFkOYpFkeygbdVt3mkt+NZ10GQ9MfM6l Va4oVZZvrkZl/gr421qNLWS4PoJTStPrjYGSleJJJ0dRppikg3LpJA0gN+ai9Kt/ kB98g+FUHlEIk5FMpaN0HuTZo0H+9ucrxJWg9uaRKc2kaWqvmk3w5t/cF5tWhJwa TfLDyzn5MpucuP+rStsLmxUf9cwGNwPXRlyALyenoeRE7JVAaEMlvQoYJ+hZjZGH X+pbqNrrh0V8RPfiyUwir9Xz/aYxalIep0N5WQVb9S2MGwDOb58dl9rN8K3/+19C JQ3TIcJtpLleRtfG130AcUqGGhwDsjWmwCU5mhZMYl/nmdkeeBarFhd6hypWo0o4 8W7/K+qaQRQwIXLoe9ydWcIZZz9y+MbnY1darghAzhlcue1YAWPTDWlck+9ozL2h Y+9yzBUREIYOi/Chdnt0XsSryq9bdolKoGS856ewIMu4/JlzD858SL3VDuUQjuFn HezDA3f39LV7yNXhiTnnyUlc6RqgVV2Mi/ECPDDeLtLaCZS0XAmW8/DI2FiMaqd7 q+flWGFHykIWFGl1QrHjghd4w0FzlQmLlwKEBAhJU8sT/cMMnrM= Extension name: a89wii2p5s ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CE1FF25BA7C81F84

http://decryptor.cc/CE1FF25BA7C81F84

Extracted

Path

C:\Recovery\8176v62z-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 8176v62z. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/460BF68515DF93C5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/460BF68515DF93C5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: +EUGyyoEXqM0oFM38Djb/JjQViNUDnN8Ua9rpvd5PFldFO5lwgv6nXCdH2CJTHQ6 WG/5eX8e+Fl8MIRmc9NAWtXpX89QDhKMmvqYZ0xMC54gQI6U/lyXr9pzBY1cBWDt rZjNRiyuImEycfWEF6oVfQfZXeupRAlTMZwt/bUJeqTP+oYbMjLAec2/Mix/nHNR KXkYGgDskjYq0bU2hx4cog7b3SymtGdSw2SD0pkZAhta4UQEkBfpzd4f8lHNwX1W aR7/Brpmte169VCntrK5PD/uUXtXsd1r3PRu3vzN4fDpWMMskBsqX2FE9zQVch3Z aeIPZQtSr3TNqt6oFbhJcQ8H0uiZ7Iy1kjQr+0GS0OYmrbZlja0N+oM8UnI8Mt59 HGZlYyoL0DW0s+eMDCiGctbOCnq+FXpliqEtI6qd3tao3sE3Z6xd8532d3gqHVV6 44giZUZDAZ7UQz/HcFg7HK2ZYb4+Oug8ZnlLnFv+jA+z133f+FoONL6BpFqJHxSt jzYOinQN37GmQCzSbhY5KrR1Pvk6syKZFQeCSD5+Pt85Y4LV9esb4Y1+eddFenqu 8LbwvC6EzNYM31b+w/JJSgGyCd3zFvMPDVaiOAGAEH3Y5nIE+YwfUXf+GHDnKg0x 26i0pePTVPjxcGFI/7Bbqjk6ZLqktAN/EY7NVUugQ89KSOlo+zofy8Y/OJitilZe qB+OB9tp5jFD6UGJVHcgYpQ+o4WSeH+NWiqr47cqq+oIzoDF2V7OT2/0cqtuRRMZ sKODKmD+ysMThKSgVxBFJGdV8+9NoOJ6u45aXoYKqMkRDZZz43CfdKQaUEFQ1ydW GmW9x8i3DYnEzS2agJ+xiMUNzj3J1T2kDyCnLA9bXagKfticO3ISnSdR/zWkVz7D ZQwA+zfoCX4PCP/tJguFWnNiIoIkW7WrE73HnqTmkz1dgW6ZEsu/07g4TD0KfqBs V5QdJYh/HQs3D2yALGexT+v5lPWwl8qnBpx49BUewFaplpFK3IFpnlUK3yIDjXHC CPS5sHrUwlmfgpX+N7WtXdDOpdoENxVgzkAbcMqBWgjpw6B0j1pk/B6eeUykRvds wgVxZ7UPIRj5+m4Ug6CzwArJXryTZGRLPQZXLgzjrN+KnCf0Bzu/Xx0Ei4kr53VB Hi3jcyqduq8Rrz51n0CPgIm6MtMnTsoGvL8MhtCl2cNZl8pRMud3W880Slh62WrB Ps2fiY9jz5yxHeLxqBJf5wtsUagyiYZ92KSG0pQTpRTez9rgTwo89AOPWm83mGmu qOJj1SvkSIrYuaeflE6cKet3Q6T7wiVJrsmOq3N6d4vCZNcqPs2j+9Zxp5/tuHxE 9i8GDZflZxKZflZEqDTodbVxJl9qjb8YLscO+F/m4ueYmA+pHwTeYg== Extension name: 8176v62z ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/460BF68515DF93C5

http://decryptor.cc/460BF68515DF93C5

Targets

    • Target

      NEAS.6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe

    • Size

      166KB

    • MD5

      44c753ed1faec948b0d98bc9ba047469

    • SHA1

      1aa2d575752dcfa73ea8bd2fa666e18588be353c

    • SHA256

      6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01

    • SHA512

      f7d4c3988f82839264e83c1a17024c695bd8ff31a224eba3cfc9e3712758be5450521c1e52c246b02dad0849bdf381ad40d77e9b5bab6f8135f07219c13047e0

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QoIeXt5KCn16:ZJ0BXScFy2RsQJ8zg9edTn1

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks