Resubmissions

03-02-2024 19:47

240203-yhy6daghh2 10

03-02-2024 19:28

240203-x6yn3sgfa4 10

General

  • Target

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.bin

  • Size

    166KB

  • Sample

    240203-x6yn3sgfa4

  • MD5

    340b6f816bfdcfcb466cfc126c976844

  • SHA1

    e2e3adfcf621166a9f5bb7ee9795b7914cda2095

  • SHA256

    3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

  • SHA512

    3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$maSqYzCs2s.gezYwrFOoJuI4SIRqDq0fr0z6iKBeb4EdgQpwYnYjq

Campaign

3385

Decoy

balticdermatology.lt

liveottelut.com

michaelsmeriglioracing.com

spsshomeworkhelp.com

campus2day.de

madinblack.com

tanciu.com

agence-referencement-naturel-geneve.net

jakekozmor.com

tinkoff-mobayl.ru

myhealth.net.au

maasreusel.nl

pmc-services.de

evergreen-fishing.com

noskierrenteria.com

galleryartfair.com

importardechina.info

trapiantofue.it

tux-espacios.com

ecoledansemulhouse.fr

Attributes
  • net

    true

  • pid

    $2a$10$maSqYzCs2s.gezYwrFOoJuI4SIRqDq0fr0z6iKBeb4EdgQpwYnYjq

  • prc

    thunderbird

    thebat

    msaccess

    mydesktopqos

    ocomm

    ocautoupds

    outlook

    xfssvccon

    wordpad

    encsvc

    excel

    agntsvc

    sql

    winword

    isqlplussvc

    powerpnt

    ocssd

    dbeng50

    synctime

    visio

    sqbcoreservice

    mspub

    tbirdconfig

    steam

    dbsnmp

    onenote

    oracle

    firefox

    infopath

    mydesktopservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3385

  • svc

    veeam

    backup

    vss

    sql

    memtas

    svc$

    mepocs

    sophos

Extracted

Path

C:\Users\63h18kz4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 63h18kz4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0CFB4CA8D6C3346 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F0CFB4CA8D6C3346 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: aQVy1OMvgYX3KYZ7CIagH8IhUMDHU0ZKzcAUP2fcN3hKcO+VkhXLr4CW61L4knEP jUNDmt3Wk6v9vbpU+x7iUmGrG7JOKmLbqiOqjyOD590CTZMlrdag8BUkEBbZBitS ZGGKz7T0WdByKxblD7Ekn2eb5rKYzL1uF9Of8B8vnDt1PkaD0pEz0hxLlusmhk3H Q0FY6UW262rjGKf3Veeyz1bbWdx8SMbpPyIBDBB9iZYZujwXUtx8qNsUzJZsSAgL QwnX1WguvINM4NbycbSlceV2JLawuhrrNdDdbfeK+mZVtaKx9r5POe4rPqHGp0U4 6o8BEjJGOQttIVTQGmdKcVtQXUgDMALk+Py4xHyn9/7QLHmUmL2daKzioJcM1xv+ hrxtz45fM9oLnVLUtodiVKUaqUWoXVi3LisJkRXVXWsoXHWACNm1gSGnyFgm7+kV adDaQTajOX9We9tPkQlL51t9js3r5sY5w5QcFQlb59vILzmupLT2p2SumHwmsx9k 2d8t1ZrSXncgNFvYquJd1pXjLD1Wt4mkj26htXenVdl/q9P4qjOnn4bxwRgeV/in l6htE3K4tLU7Fi4kh2JLyu/bYVtuqWCdozSdcJbrQzauvgQN65Yw+2zAOFA03t16 58fG8CmQ+8pGjlPuEaIe2E9FVTwRDigUgl3m+a8/3XMCrbj/q8dZt9C+Qq2u3GmN qDQwa/HwXVWrgHP9E1v6GQVJ8qCTg6b788QwLayLdk2lhGeM+ECRYYXzBGCQ5WGG 7Fss3lvCE+0wdwDVq54ezKCDtmvUtqlpMnK/ki95EFFRs1F94s78cFDyDqKoqidB zYcxXfhhEqp27sKSEw94mfg7Mgade6Voypa7CbnvujJTkv9GOzTsHS8BNoUib7ky JZTBik3lVA3fn5vm555t99hZlvpxfrITcCJGSQLoJMdFSOHxXwsYR8mbZakR8SAJ ksqRz3zVR8HTrJTsV2aG7Xbq52LCwb71B68CNQmVsU+gbYlQsgtK+vCFzuLs6srX QfjtFZI0lf+87YP80fBDxp6pj+8WdSkKKXPZFsQXrNGg55jXPfyDFHyO8YYJ1Oyb LFgZ1ZJD9VU3/iBWHYweXb3u1QhftM8s1QdqTS1SRc+cgrN8Ui51fXmBmNHMftSq pHUJviBcX0EXBea6mbEmuZV0WddVRH8/ooMBxOmqrqsR4oUcXal1jS6y132QvTzT FhJjmJxHghzAWo+Xh6jKnJce55M+T+x9srv2kLqpUC5XLR6nHLx/ZqiwBRgsydUj N2M6OI4m7Z426PXXSu/2bgYrS27U05TP6pvmSVj1lHgmYbjT9HMggsMlwyVdLs26 56hXFdwjfsgz4k327zefdIuwvPJ9IGaKt8x80zYs8s4aVia/ ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0CFB4CA8D6C3346

http://decryptor.cc/F0CFB4CA8D6C3346

Extracted

Path

C:\Recovery\d0ql04e8e-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension d0ql04e8e. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08C8AF9F4DEF8153 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/08C8AF9F4DEF8153 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NmglCX0LSvhiY++MBFKLwFTAyZcUJkYZdOUNdWr5rj+jUt/spLVMsqcNhJWvISXT c27V/h4YDKjrIncrK8XzmHw2I6cgmtE3WbcRsfFVYDBYEDlANJkQxez+rzGeDYWj aHcY+3bL4vlogvNpgXw309+n1wRIUMIxDqfEUBlAcRs2lHVGpbgENdjOjKbRyr7x BM2WE9bPCm99twdKvKOpgR67EsLAuy4DY0S+HyPhmpm6AXCrOEzJcud9xCwHBgQM rGNlVvr92CPb7hQ8zHsbJnB847lDUcJXWH5I1cdxoAy6Rszz2ReyxC0UiJAGauGY mt/u/tt3xfPbhv06EHUjRWgltiKD9Kn1b65Bd3XM5jAmWbczF7fcInuR8bZKdk0i zCRdlcWCk1GATZxngyeUxiwkdYmXl3/pqcykU//q9wDHvPp3z2NE5+M5N8iTGLYt VxBkeOQOtut7TNsEBd3yt0GuzgQlTJ4EKOqYnzNrcllLV5b8b1nreyk1z6snHW2m 61Nj2xxI4ly0CuzMvijc8ytJ82k6wqF7k8bPnpSJnDtEERMr8DKfaWGmN770ol+s ezArrlsHgzAsoL+YtTnEINm6aqslX2fO3NGA/OK9xP9glA37vXxImLM2GpLmMmZa clRaA2EtMvt3iL1XPErUZ3A19PTbQuxgt4qlBlZ9l7cc1oQBQ2F02Yd2dHEcvUPq iIDwL9e/Y6wxaOCKh8JK7P0XaKCMN/EPHVywGHs/9Thfzv+tFwx0Ge+f234a2cwg 5I14d0IrcDk/09se/1jTU1/LoGJhqOmV93auf5rldKiPd+blRBoBwuJnukqTXVoE Uh5BV6XC3o8OJwT1EKehtKfAYHw5hiWHOCq1xmT9w+bCDCqTj1BT5GFJE1GXI75w k8w3n8pH+VgNBZ02TxoBQ93xprTmrtZxAGKWuWXjqcHzEO/aA/bBWEs+FIS4sRhn 1HvX4wYrLZsr8s5oFKuN3BTCuPUOvZ8MR+hOW5h4o3E50kSoqn2jMKezopXRG/PL 1fFiwRQfEYAFrzmMnmeBjVW4JEix30UBx0CprX5jC04jNqJovTboKMcctzz8HCbS +QyciMvWIotE0VSf4uQnPk6sxg3KSlnwP/lZrbKrKLfUVqEtUvP9WtaOtDfK1Kpj i2NlXuedCHGy+61ldIGIByonwfi2yWD+Y6/te5wAdO3T+7P9fiXM983DZjf7DPmW wE4VGe3u+W8Cyy+z0YQITxNcCJVFyqwWT26mjADYTOh93oLWWekHZW2oW+moiz20 hBprlZrIbJxgtIs3Bs2BkpMmrJShg25dvOEDssMpZ9DlxJ6UZJE+AT4rl6+Bm7aD dl6Coe//sFi1poHuhl6mdbRJ/RQcZLNv4FZLaRtomA6TLX/K0Pinlt66/Eo= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08C8AF9F4DEF8153

http://decryptor.cc/08C8AF9F4DEF8153

Targets

    • Target

      3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.bin

    • Size

      166KB

    • MD5

      340b6f816bfdcfcb466cfc126c976844

    • SHA1

      e2e3adfcf621166a9f5bb7ee9795b7914cda2095

    • SHA256

      3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57

    • SHA512

      3e729878fe7ae2ea2f025d71d78226ddb5930b791143eb8c4ba4a7589d5944e5b0e37e8ffe1ea4983bbc66c71587e3a4b158b3e8a2b71ccbed2889c4778962f9

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks