Overview

overview

10

Static

static

3

6cf72f5fcd...9d.exe

windows7-x64

10

6cf72f5fcd...9d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6cf72f5fcd8496749d957f99e8b7489d

  • Size

    12.4MB

  • Sample

    240121-lkpnhaaedm

  • MD5

    6cf72f5fcd8496749d957f99e8b7489d

  • SHA1

    d1c46bad88255b82ff264f821bf3476f49f07fbd

  • SHA256

    5edbbf6443f06a4c257794934ceccddef65cbc68fd0e779a11b1496ae9e51eeb

  • SHA512

    1e80729c3e3aad324f24c2dc2381833ba8066b471b4f46f8bbce13f7cdea66adcd0a796ca072564a820feda0aa29ce0de45fcee2115ba0d13cfacbe0f7e481d2

  • SSDEEP

    196608:0tObbMT9U95PXZYYFjsQ+YIs+GgALUMLKz5rETUQRUlMCBaKszvo7vsmYbG852K2:b95PX9uQ+dSez1+a9cfzveUmzzaN2

Score
10/10
babadedasodinokibicrypterdiscoveryevasionloaderpersistenceransomware

Malware Config

Extracted

Path

C:\Users\r114f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension r114f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/74334F7798F6E8BC 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/74334F7798F6E8BC Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: pFIXgTUPe5I8Gq8Q36ssTUJNDlqDG6CFNsRNqIIG/QGmalRxTG6wB14AVEyUrNp3 06HZvEa1M9ODp8P03VXaxTAzJdCvoBuCuSqPt12t3YuxHkZDJ12JTPZsmj+Nd7EB xxNVNwGmYkeHM3gs9f9pfhZYV6615XngE54zjY9xx6vXAgPMC2txHUcoT+fYoJhP O/0qtYHNSiog8mFJ8OdeWiECmdjwP+tbyzKwPiutw2S07GOrbfR7RD/fgVInw4f7 9p1vjQiG+Bfg5xZzEzxvqZAQbginXxZqZlQMlPiU9xdoIAk7eWAZZxlnYX+lGRl3 Qd0waj8ADZqUqv2dO3Qj8itJSGd+Ts1J16TQ0VuwCr3F6lhBRNoHL21ES+RWw/zX u4uXvLA80NP3i1t1lJ+f1ywXKcCe8cuTIb0ToX0H72p3Lo7NjXz++vAc8kIKnV3S SOT1P40iqNAKjMI2g2XQSr1Q4s2eUvkx/Rv+hrFDkepx2Cn10wmPs8R+xGag28c4 iN7ti8ey2Rucz74I866zHu/3J03iQy0PuQGKmX9UkGLhTlJzC2hSoxwPtZ8HFlsr JF2wIP8Pr7aTh7kAeGZDIsUFZkYSw2yOO15w+JjrPYL2bPd5O7EmV9hyos1dV81C r5v3zqn3tswT6Srm+jQoTCl9m5PMxoSPkSYO/YwSTFMbzCdFqfBg4pZ1hg+TKq2h um1Y+5iHUxFCxwXQq4hn6Gr+zFzPK98sMRYlZxlJZtB86iZBL/JNIk3stTiA4/Bs Osi+fNd694DY0Oyax2A1W5XdCSJVdb5IAS4f7geGa1V3J9beNWCiyYVD4egch1Xu ZHt8jB7IMgSHxyvjj7z/ucoBY0nt/r5b3KAs+HGT7kw/cbhSKHb33LtAgzK/BThh 51+qV3yM10F6TRqx55H/zTF+Vo/5G+lbw6O3ALzvMlwRGFnPp4LYknkto1zDkUJI SL53CaH5Ufc+TscKpuICey16qPHCLGplS+w1/e57C1DXNJtdDakDd7kie+yQfo2p M/uUue9Fi/VUDByVVswTBIgD+iV6bQQs1pNaAQ9ZHTl78DQ/4Sox1Sp0BbgRbwer EdDzTQpqGUAXls0w4K3uYpPoYUl4MnfeewB3D5kR88bAJ8YedibzxL13eVZEigBk LDtA74SK2XGqn0qixBc//wYmgwm+d6xOzF05pJjgyY00Qm/9gxkqzS7nx6spyUVK 8ZEzEqh7usCKvSKv1oMSQi+tX1984WOAlHFtX588QrH9Ay2QkHtoK9XbWWg4qjW+ CsFFWl3r8n65lHxXGxv2oa7VoI/m8YI/aLSp4Fon04GIeT83X9sg5XfgVWNqulwB k9+F6AN9hHQq0R6RuNzFDGWZ+S8= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/74334F7798F6E8BC

http://decoder.re/74334F7798F6E8BC

Extracted

Path

C:\Recovery\zzrd1r7t1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension zzrd1r7t1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/053DF435027E8978 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/053DF435027E8978 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tkAgWQ0DE1zJRIJAfZ20q4HpvLVWIePaS/ndiYfuseb76Ir7xpdP8bOdvBCsi6U/ 2hYbpskcpJC4Ki2mPDf0nPn23VIapR7cruuDYGsxK655MfrZ5ksxSXb5Xr9hLgGy HOVypAdwMCaaEwOwgds4v17UnnhER9zcFTYd7WN9+SF0ITxHGCU+qj1LV+SDOrm7 uGGRPZgrYolYAw8nElD6vZPBtlm1F03mytpShxBC1dbinZTHTpqHevp0DBhQDHbm g2pFFAW5pRKY3MwrupHPKvLpFZaoq4HUnJD7SG8zDykIHFxxKzNY0ZiMSXF5sbMx iBDBWmeVqbIGcTJIsrgdCvhQdfmwMeADJ5Llj+AGUYf7Q79SXzAjZJrBM4Fmq7y+ 0ULtKbQH8diOyUAVGK3zaWT0AEFpJkriXTZYXR4ng1iWwd4m4Wz88wJgwLw8kKda KhmZttwgb7pNrdM/VApRjnf39HxnEDqY9WpYCHth70y0vpdHK1wbliecKlfvE+RM mv4iir95idqWFsj8TAaNc9XdFwY+lmirOLE04s2CaxGkS65XgjgNbB+Evij9BvGy sunefl/tAm4Orn2mprMQ4t2EfayItYLt5/QqEzmIXeu8C6Z7PHGMjcnZxftEDVi/ i2w2D7c4yU1GcS6LXcS3jBvdfpZTCRY3J7C+ZrfszUVVe50m340Q4IPbDVa+bTUP ofhJQtzsZQbLGxWkubKsYlY5/1eN1SoNImPHEak7RK/Hr9LU6rWui1PlGoQBX8hX wiVcs7tGYdQPp5LdE5C8YnTuZsLlDCpEUdMS8ehasWDUChPPI6Sj8ZRourVzwySx KcAud5zjrEyILSTBffmrvqH0l7Cd+SlzpGlWfAlbWPZIHZXy3VPdsLwM8XFAXkTB dgCBsOF5hw64W5m/GZ75fSgLJw7c1YZzxt3DEJD5oTxUyH2hcnR3nnk6VlQ3gKro eXG+VmhrOj+bZPbP9KjCto6F7exDeerPPlB7UW+JNOHKLSVvRhifNgqUs8LLSWm+ Nz09Ex3Wp2J6McHr5XBCL93e1g+U9uEQpXhxCYcGE8GDTMcW6LILWv4yEmK+0aE8 zJUoostRft/fb0Dy0chPnB4YwtcUkHCLef6y/inNnn0RsCf8uGYjgAT4XGRMKc8E KXHOujoNNG4Merl7bn8a/aq+5Vf4V/SaFPyDPreGp1ELCxPRFpZsoFtcTNfkaDWV bkQfrePY77igUppErjZNRKMYmvFDQORrP0rYOD1rL1hXD77Yh+xVZ481r6IV8+PV DFQJInfuHT8ltB/enCippyVPsNqXEBdhmLIoG8pOxPumOVHqnGotTZ9gtvVceOd1 VPwjerTKHSAs22j4bSE8nKpPj8OdEmYOfffPc0uA4yALqA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/053DF435027E8978

http://decoder.re/053DF435027E8978

Targets

    • Target

      6cf72f5fcd8496749d957f99e8b7489d

    • Size

      12.4MB

    • MD5

      6cf72f5fcd8496749d957f99e8b7489d

    • SHA1

      d1c46bad88255b82ff264f821bf3476f49f07fbd

    • SHA256

      5edbbf6443f06a4c257794934ceccddef65cbc68fd0e779a11b1496ae9e51eeb

    • SHA512

      1e80729c3e3aad324f24c2dc2381833ba8066b471b4f46f8bbce13f7cdea66adcd0a796ca072564a820feda0aa29ce0de45fcee2115ba0d13cfacbe0f7e481d2

    • SSDEEP

      196608:0tObbMT9U95PXZYYFjsQ+YIs+GgALUMLKz5rETUQRUlMCBaKszvo7vsmYbG852K2:b95PX9uQ+dSez1+a9cfzveUmzzaN2

    Score
    10/10
    babadedasodinokibicrypterdiscoveryevasionloaderpersistenceransomware

    • Babadeda

      Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

      loadercrypterbabadeda

    • Babadeda Crypter

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

      ransomwaresodinokibi

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks