General

  • Target

    6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.bin

  • Size

    166KB

  • Sample

    240203-x53xeaaham

  • MD5

    44c753ed1faec948b0d98bc9ba047469

  • SHA1

    1aa2d575752dcfa73ea8bd2fa666e18588be353c

  • SHA256

    6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01

  • SHA512

    f7d4c3988f82839264e83c1a17024c695bd8ff31a224eba3cfc9e3712758be5450521c1e52c246b02dad0849bdf381ad40d77e9b5bab6f8135f07219c13047e0

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QoIeXt5KCn16:ZJ0BXScFy2RsQJ8zg9edTn1

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$fva76xkUX4MoDJONImPZ/OtsZkdWOv42SsOrVCPbhHubkM1Qg6S0i

Campaign

467

Decoy

hoteledenpadova.it

thedad.com

creamery201.com

songunceliptv.com

icpcnj.org

ogdenvision.com

craigvalentineacademy.com

bockamp.com

naswrrg.org

pelorus.group

fotoideaymedia.es

wurmpower.at

gaiam.nl

wasmachtmeinfonds.at

pasvenska.se

jeanlouissibomana.com

kaotikkustomz.com

id-et-d.fr

kevinjodea.com

bestbet.com

Attributes
  • net

    false

  • pid

    $2a$10$fva76xkUX4MoDJONImPZ/OtsZkdWOv42SsOrVCPbhHubkM1Qg6S0i

  • prc

    isqlplussvc

    msftesql

    firefoxconfig

    mysqld

    sqlbrowser

    ocomm

    thunderbird

    infopath

    mspub

    outlook

    sqbcoreservice

    encsvc

    tbirdconfig

    onenote

    mydesktopservice

    oracle

    xfssvccon

    ocautoupds

    sqlservr

    powerpnt

    wordpad

    agntsvc

    steam

    thebat

    dbeng50

    mydesktopqos

    synctime

    mysqld_opt

    thebat64

    sqlwriter

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    467

  • svc

    backup

    sql

    mepocs

    veeam

    memtas

    sophos

    svc$

    vss

Extracted

Path

C:\Users\5c0x4h0-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 5c0x4h0. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C542EFCA37223102 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C542EFCA37223102 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: nXZX9hI4wzAJoNoUne0FItHoBQPyaWuofxKXgPi8JmOegVcd8PkRbxoKGrFRasum kRsv1o2tiNKNRNb8XcXu3aUMaCSwVwabiq0gSHHF4B8onMcrTo5c58dDPIJdLsla FC0F7OffcFcGMSZBUW3Ha5twyV80y1OJl0GWwOPou1tPA5K6hGvn/AKcCVaeXDVD R0bw44sm1qSQL2Pos+lUUErhJssW0eVcADPtWEEVAklqMVN8LFwdoPbcnFTFlTLr 9+B5+X64VUyxrwSEou5K2wsRGa0Gi7pajKDBqgzKae3xOCvaDctI8LkLDJvJPMhV PMWEWb9SklP/Eu1fNGDYKumau6wALx92BQ8zCysKqGRlpl1YDVh8Rn7QP1uNfuXo HwxlhGeyqenSVXkQxnNyJ2eZuQUzQ3P/2WTzs+fFmbb9r6PCvpV/t2D0O08SNru9 va2+sSxQsu61BZ+tiodozsOQth9U9aY4RXHqLXyLPaA4xlomkOW81wsSLBZO8VLg k6QDvVuTVQjHjLxk+MHfh9Ii0dAHGsLEwFbvjxmj1CXwxy0WBH6vOIloMxoc3EmK KKjFR91dA5AzptNe2KxkIOPSNUT5lBTsL26/7VPLs8ufCPiyw3EbmSVejVGUgN7l a+jdxwa+WJc9DTFtJl0WH6lNfrl+Y3c0rhrutrmYop8c5zmIiCdMFQDKdylWd8QD ZSW9dVua+quzUla/2DG8XW58eyMgGzywrRAbHSwAJBixnNMrVS5HoVOGUUcIyDaK puXYNl7HRmZNOXo/emh+Jzjg1ryc+Yfp10CZ7bDDwYIjjmQb71hGAjRU7kMyekBk 5R5KenDM9RFE6WZsYH1GkK4KQknZ0xPlMsoFz+wJ7fGZOsKaY6LigugKf05TqDbH USdJPdOLiMHLrO6vPaOjfiOCbtRVkkEkSrNi6qeeGDeuernutGt78sojyfsKO9D0 xhgk2f5ujuk1zoWEJyMhT4z1uFlJHtHieHyrHOdkMN9p2tjdujZZ70pnVm8Tjk8V wJhvBSwYQuIZeodfK5fIK7WDlUjKJsMg3Oj4VO88CFW838apHadN4JG/LBwXYxG2 apGWJ3AFa4ZNjL5cBfnQsi8n7gob9T0z1prEUDNLPFK/QOiBcCyEkodiRfWA4aX/ iSWIO0Hi/zWMyS1NsPGQVPb2jbtPNuGPDPpZNdjpXIhRuMvTrP9AvhABMR3IoD6h FPOjJokEIYHvUMq8COkEzOOsUIl65Hq06Thcgka4XrDzSnU8E6Iirz7XSDUlY2pR rr/KeL88fUxZVXMwW6oVZmJDByegfN19b3uBGezRdCUXoaf3q/X5F4z9sDTlr3+u LI4LN/0rfPjCQC4EC7XXn3bvRgTWQDR6/nYkKtWWf7s= Extension name: 5c0x4h0 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C542EFCA37223102

http://decryptor.cc/C542EFCA37223102

Extracted

Path

C:\Recovery\ul834yu-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion ul834yu. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6008D5BA8BC97D2F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6008D5BA8BC97D2F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: j1zCfNBmmsBYAv5f0XGrlAiprdcPNMEtkRDJrXj+wMyq+VhTPns2z0OJxfZguAc6 oZchSpu36hlWz526t9j2leCLVwJMfhYvle9yxr/XW0XjK+a5ZpWvx5bB4po1/BWG 3x/Y1y2JvSXl3p9rkwyaIubvlLzjKXrDuXTSF2m42XUJiOfnBpUqd5ePv7Wfe1sc kIDyDc2eHbJS3Rx1exufA6+vco8Qn+W4rYPgwVdfPw7eyY4sNen7EqsWIIKIP65M XUP8QUqQxQTwBRttjknePGs2AWJltSN3SJoTfSUTj/B/KB6YbdRbYNWj0Fhj9oyN b0JecIp9AiRkfd7DPnvRzF7iSVwixG1GlYo6lfkJ/XUQPRk7zUcdn2yxBmOzqRCg FyDZoBZaiyhGQWcEWwZe77rPT/ES99IdLa2Ffo4U/fCogedLqdDAyPW0+nMau33/ VMgPan5dlme0ekSDteAjXZraJSbZpEHktSqxVadnT+j2PP5G7wVtE4y+v4RXEXDf kGtMLlEvRLh81TntgG+ntURonhea0UdcsafJNZt9m2nfiHuHcyoRRIAHPupfqxlE RYsgXeRseQf3UXS00H0XXCsnbYp89vrAtXH2RU/0HsXftIaAjivnqj1h4VtWi25+ tX4f+b9tQNf5snDT1tzxARY5gwfX1Q1Af9yLWSVUr2I54o8vfl9DOg6MaLf1dCBX GWo+Ylw9zMNa9jpbybtf/nVQVLfl9FkOlfIKGCIz+kR8E5PpQBrAU0IZ+LsAt6Dq NyAPj3y4MTnaiil4xRPK2TKe9+fU3/yBoJP5TbktUbL6mOKCbcp+q80+T/2rIKZh 90FYW4W7Z0Iwt65j8kE6bqoF/W7zRn3MmeoQAgG65UTYeNNHNoAx3UduWbeCm8VX t9RKtXYSnj0/1sEeuUBhCev5CWDORTW29IYeGxZSG4JRDpT6G+BLFbFIMHPn9PNC jy9z2Xh5Nh0EaaFinkGfkoOrtgBPuLQf7NvIUkyV56PEJoWIYANUwu6omKrZEE2y yp9XgSwM8g8esJo9GBzy/yO4efDMGAmIrv4GjKTkoZ0myf9E+Vjg1OlEBwffWQT0 gThyDEWSbXPT16YrutV+hZIHM58CgLIPyTMt4HKh2xFz3d5BNJMj8Bthqdm3k68g Qjzif+GHY28UCAio4jlSUOrrtMDuZyLW+kxXB54dPF1h7+nVPi3bEjXyShG2mopH lNl7E8ecdhS4npFMPxk4XI11VbY3+w+IaPYML/JtRmWeLyIqxLJ3p+IbkkXBcLC6 QFMqG9TgcGzarI3CIi9Ky4jWhqSDSTUIkRLqphfmrSUsztS1OHk188IxEeEn1sdt US+WgTcvhXRlibAlQSaJnYQJUlmzBY/J1Oayx9iksUHL4nHIcNY= Extension name: ul834yu ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6008D5BA8BC97D2F

http://decryptor.cc/6008D5BA8BC97D2F

Targets

    • Target

      6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.bin

    • Size

      166KB

    • MD5

      44c753ed1faec948b0d98bc9ba047469

    • SHA1

      1aa2d575752dcfa73ea8bd2fa666e18588be353c

    • SHA256

      6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01

    • SHA512

      f7d4c3988f82839264e83c1a17024c695bd8ff31a224eba3cfc9e3712758be5450521c1e52c246b02dad0849bdf381ad40d77e9b5bab6f8135f07219c13047e0

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QoIeXt5KCn16:ZJ0BXScFy2RsQJ8zg9edTn1

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks