Overview

overview

10

Static

static

10

92bfcee9c3...ff.exe

windows7-x64

10

92bfcee9c3...ff.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92bfcee9c35d12182819cdbd8a0be9ff

  • Size

    92KB

  • Sample

    231219-y5a23adahq

  • MD5

    92bfcee9c35d12182819cdbd8a0be9ff

  • SHA1

    9df82000b77326f14e12e7ffcbcaba1fecb678f7

  • SHA256

    62a27299a63f16f14ab36532e5afc203f817df9eef94630a4873d35d8f685fbd

  • SHA512

    6418c2a9807d27a9d15e4a49e7da230ba241d2eaa29518de2186c13322f4b27763f4fcb29e23e5d7171d2f088c35cffaa4f0c8ce374fb0b7fd6dc50f0dac70b8

  • SSDEEP

    1536:o73nkB0DyMgQSm9NwcKzwpR+7JICS4AR8ujGC:M/hKzstrZ

Score
10/10
sodinokibi$2a$12$/icg7f9gs.ilg5uoy7p.eejxpqa61tmjptceh37712bv/w34pztme7456ransomwarespywarestealer

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$/ICg7f9Gs.ilG5uoy7p.EejXpQa61tMjPtceh37712Bv/W34pZTMe

Campaign

7456

Attributes
  • net

    true

  • pid

    $2a$12$/ICg7f9Gs.ilG5uoy7p.EejXpQa61tMjPtceh37712Bv/W34pZTMe

  • prc

    mydesktopservice

    mydesktopqos

    sqbcoreservice

    agntsvc

    tbirdconfig

    excel

    outlook

    dbsnmp

    sql

    wordpad

    winword

    thebat

    infopath

    powerpnt

    synctime

    visio

    msaccess

    xfssvccon

    onenote

    isqlplussvc

    oracle

    dbeng50

    ocomm

    ocssd

    mspub

    firefox

    steam

    ocautoupds

    thunderbird

    encsvc

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7456

  • svc

    veeam

    sophos

    mepocs

    memtas

    svc$

    backup

    sql

    vss

Extracted

Path

C:\Users\0yhwc87-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 0yhwc87. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/69169996152043C0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/69169996152043C0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: LCZ7vnF26bM4ZF1ztz/8IKviDlOHDdcsKUyM00SCLP2WAc2LB2kuOTsegzNrXXJm nEpdym2GePxb3SC4ig48zsFTeZIBjUCz0XU31ButbySgKNPUcPOYZBVbSBOwZvOH DWQCcaFFhRmp0ti/KKEOfLsFI8tlIDdXnjV0H5tYbg3EIsnvk2sIdTSRUrRidyPN +me27ELhVrrh90ss3Yxa/9Qk6bJCBaucuG9RUSw/PVWhn1zp0KLnONQCGF6bTuyW zzMtPpXGT1Xd42icrYnZs/TggEWs1T636jU83hbW9FNUSJl0PxwX/dm3BFHa5mdy XibzT1WRkcRKl3Q7gBhnLp09miuL6fU9nCP/EGefws3Ackxt+iWVPUQrUhmgoTkO gtogirDfau6EqeRZkAPivCeu8nw9idtZ61ZrVaI/yU5Qt6CZvjd0e9Gc3FDGVcYG hPE3HtFZikN7kJ/jtC5s2hp0OUtPVZp7+uBYI3Yd14ONH27GhZyrOkbFD4LhqYFA lzujftIb/T39zv2etx40IiHJ8AXv87fodSoQYejXZJ2FEp4we7BeIHkc3ABE+/Cu z8S9igZ8Rk4uEh+5fW/BL8JTNHT9K1+cZMIZWDqNz6wEWi8iUbu6dXLj82FxxUZz Zq0V6dLuPfWksK4rvJi2q7cOU1MEKImVFwM8AMiiOO785JBz4reSY2Fs5sOOZ5Hn fhpNHRgergdUQCbRXgVLx3Gkr1GKr88SIb3Xu6Y/AtgIzeBbysKyn30k8nM5T0kn +RQ3sPCmtfr/yUT4jghnMvyCw0fyAg4cViI4cDUOVfYhllTlSEbxUe4E6RDSfPR0 uejmkOO3FSWmS68RHAXvUSVQN93pyA7CENltqvdWekgQrOERks9V8VupenkwA75V KCVM2Yxdc4oCvZEKE/xUU8ye1xSVtE7IeVZlU9at35u8kL018t1LUqlWxrD2aURi yK3vjrIBx8NEl8Qi5SJXhN8FitTDT0JI3J/ObScjSN9aCj8KXaaCPKRjYCbRUoZW BP0nDPr8UhvQWuyEMsaEmfERJXPQBjveHLt9WEpzCh05cI1CXG5QqfHiVQlENBMP imoGZ8D5nhziNerej0is7umgXwTmOgDFMMxHVNi5pPIav2WCdVsLWkei/7EIZ06R TAMYs9URM8WtLa7eqLqytEdkOcNFrhYbLn8/3g/fAOnzqxSICX2aazGWVnQfSo2A 2SPVuPFGAn86+Lt5P5uleZX/6/YCjHMgLpjj7h0JvKJkoY/n6dFiHukT8P3Eb6yb UuB/lLYOGlTbslH+4X2DYkd8N6eVxlcRjeIATPYVCDHtU7DdjSC9BzjBm8kTeGtU 4DRQQPX2XiVZd83xGZ9+g3QGZ+HiDoTM ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/69169996152043C0

http://decoder.re/69169996152043C0

Extracted

Path

C:\Recovery\j4el2e-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension j4el2e. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A15E6B5C7D1332C0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A15E6B5C7D1332C0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: MDcUzD6NngI+dBLNpRXTj3KTmh9/sswCM9hW128nUm2Gd1sBdHgTRxIL1bmAxmyM YactQjREgXt3VEUtnvgv6IORIArvLDo0hLLfpg1bvNMlbHZp9GPgmkPzvEd5FEij 3CAOZcsxFEljRwtgacua7YsGrWAcJJ8n+5JvOEo5o5wtLPjsqpkXEHcUAX9CEgnE OKjGds9VqehpfP6PMxiIMbwMbY/5VOqBi5cGklTirHE5cPl2NN+Krt7zzpgNK91V l40RbiwbGSCAvPwzqd+ow0582R5AGH9rpYTk2dPQGE/DfSvEbIy4gBB27f1zt2VY dXmuymVgiKG5aJBIPossDnstxpFpwmGpQ+hLoCNiHvn4TabZQkXCF/0Nd64GpXaL OtGRQj31AQ4WC8CED4Jxy6HQSzG3pyMH3dj1iefKTGWAvt2UWcChS/ACh85gyNFr uwNAdAgK9bCwrEWqHipMz+Ynagy3Sw0awe8dvmTpAtMDa1Ux3BQlfBrP8U3QvdHs +xnkeQRE25MJdwa7keY39NV0lrk/E37LQ5fOrr9PyGfVhZfyeZ3osIkOyDbphApi ul2lGV9Ar2oRtdo2e3CheSd3KeCrUwx4G4ePpFtyCcgjgrs4Da2xHizGEHKoVRCe 7qA6ZZT4LorfGAggnNpO81qBqJeolESUefogl9zRZMJ7maP2jTTeuuB4Av1MyQpl cinySVcAwPzGywsJ39P5P820EinykvqAW22VjN/MPAz1+bpML6lYNrAGredLYLYD 494Y9TlB5UvIevYarBcB59KG7lBJipYYBm7H0b6/OtiggokApu2vQsRFH9tMm0A+ ThJyeSBB2Eb9ULjySwZSTp5x4+bxT8UN5+w21Kx+o+nD8VsFSQoUASZ+F0G22A6b 0p3/3NjgsnusumapLN0TQTOJxoXFMHv+K8pX3ymY2lyijIug/JQnAR5ZozS2WLiT w0V7d5WYqeeMbFnZ57U8PXyKvzBRuaOjcxN77CPwBgoj14/0knhYLjfJFvAHSfRM SwkdnAFFkHsDitUrmO3EQgzayKTsBKzI9Lrno5f2dHO0M83qQ0PZ+WGkOqgJ4Lfy icjiRhWootdOkSDJOn/dqtIeVhCZkDbRUzN+uLF1l9yWYXYs4SSR6O37rZq6b9LQ RUVZvCoUgwUy/pvRD22UHuNotRe1o3Z8nb/gFFbpdrj/2GyTPcBmqnuwqIfaYCt5 07LPjo8gkIO7g5aeMmbJyVZV2rSG4XTNnnJnUK8slOSilvyXlAzYXzlkVK2y+4d0 e6S7uuPE83E91Sdo8ERhleo8OTGA+Sg2jesEuDrO+JNfQxL0jLt6GG7QASN9tl1W sUrGHR8MFzHuEl76Op7Cr6iIP4fnnOLK1zlTNQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A15E6B5C7D1332C0

http://decoder.re/A15E6B5C7D1332C0

Targets

    • Target

      92bfcee9c35d12182819cdbd8a0be9ff

    • Size

      92KB

    • MD5

      92bfcee9c35d12182819cdbd8a0be9ff

    • SHA1

      9df82000b77326f14e12e7ffcbcaba1fecb678f7

    • SHA256

      62a27299a63f16f14ab36532e5afc203f817df9eef94630a4873d35d8f685fbd

    • SHA512

      6418c2a9807d27a9d15e4a49e7da230ba241d2eaa29518de2186c13322f4b27763f4fcb29e23e5d7171d2f088c35cffaa4f0c8ce374fb0b7fd6dc50f0dac70b8

    • SSDEEP

      1536:o73nkB0DyMgQSm9NwcKzwpR+7JICS4AR8ujGC:M/hKzstrZ

    Score
    10/10
    sodinokibiransomwarespywarestealer

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks