Resubmissions

12-02-2024 05:45

240212-gf6zrsdh5t 10

12-02-2024 05:39

240212-gb9vvsdf9z 10

23-11-2020 11:03

201123-a8azhvlqmn 10

General

  • Target

    d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95.bin

  • Size

    118KB

  • Sample

    240212-gb9vvsdf9z

  • MD5

    0e285f30f30dedd812295d2408f4b84c

  • SHA1

    24e8a7a0b9fdf929e6cc4b52b0470bf4f7b6f244

  • SHA256

    d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95

  • SHA512

    0e89d41a5bd1389d74e661e8f9d3efedff589c2e64f444971e349436a9b6f191f0a0d6017a1e7c28d33be382600b08d00f9496ebdfcf839943d559d1a10a8503

  • SSDEEP

    1536:ac79OtHXciw8MfMNQulioPIKNpVO6OICS4AziU/U/F20rg8sNlQoaA:EXCSK4IKvXhiU/+F20EVlQTA

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$hIPnYTfL4yAd01j./DIPs.Tdwq.QURm2fbUM4pQFInKQ45tak6xW6

Campaign

5891

Decoy

notmissingout.com

employeesurveys.com

delchacay.com.ar

sw1m.ru

sofavietxinh.com

samnewbyjax.com

pawsuppetlovers.com

panelsandwichmadrid.es

frontierweldingllc.com

antenanavi.com

nokesvilledentistry.com

partnertaxi.sk

tomaso.gr

levihotelspa.fi

myhealth.net.au

midmohandyman.com

kirkepartner.dk

zewatchers.com

lapmangfpt.info.vn

purposeadvisorsolutions.com

Attributes
  • net

    false

  • pid

    $2a$10$hIPnYTfL4yAd01j./DIPs.Tdwq.QURm2fbUM4pQFInKQ45tak6xW6

  • prc

    firefox

    oracle

    visio

    xfssvccon

    steam

    winword

    mspub

    isqlplussvc

    ocssd

    ocautoupds

    mydesktopqos

    outlook

    dbeng50

    sql

    agntsvc

    tbirdconfig

    encsvc

    thebat

    synctime

    onenote

    mydesktopservice

    thunderbird

    excel

    powerpnt

    dbsnmp

    sqbcoreservice

    ocomm

    infopath

    wordpad

    msaccess

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5891

  • svc

    veeam

    vss

    backup

    sophos

    svc$

    mepocs

    memtas

    sql

Extracted

Path

C:\Users\680182d-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 680182d. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2573BCCBFBBCCE88 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/2573BCCBFBBCCE88 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: uZEJeFKiHspOQOFKxvj1fng1WLDpqBASGMLtRQokAWDmkDwcBXr2jRr3eodWTait STi8TvhCZNPbcMvcYmW8ZgwqWMY0K/bjXLIA9Mz34Ur/00HXCoB7w7T4nSrHoWxR aKZ4nyt8qB0j050nV6Fq6rGVda/JaS6GQaB5lGwkw+r0Fhp75mAFT3cFjc0vvobM W5One/nGe4VIIciACY7C68/f7SN4Jxd2L4kBICmVnrAmZCSsNp9nGpBNS7VEokOL 38qiCldoQYeHp7K2B+O7fO6PiUjWE8wuj24w0SscD1fPLwX41/HQ4ySbnZ2yeimB W1K3wPPhGLBznmFiuUDfcCwHmxZ1lHYeniAQD/KnN2LmrwVWnWw/VJGVqOqoh4MG mZ8dntff1+X9pyUhLgGFQuy1WYWILCI0HTtH4XBSb4XwnbUma7mf+o8iK593R4f6 TT/WiNLNsF4fKBdUSZ4uaBnf7szw+VJX7A4AkbKexScJRqSelINS9Ah/cQyFpfuR Hcmy/2m2AR4y3SP2d8yiHXKsEHsdhZBPeS17ZqCAc6b7mE5Js1AHtKhxZMD4iATV zEQsYyUEorOXqMgFYM0Kh/s3Lrc/R6bxxAiPjHemR8rYYzb8WSbSJsh/aY/+eitw TX+4yJ16frP2lSqZ21UiY0dcdySENJYn3brKfpMgg4Cax/e+VyMUDKeYEHKcGawB 0wcVZYzBfTiENQn2+hW7XvVEMilXOveX2mJ9PmMaFNkQrfZGoxVtcL2XyEyQIWR9 4llBcynMaetzCwj53kK6eUF5cUbfn91Ij3NO7USIrACLmiuxZntWOmzkgKDDxGFI hrDBlgFVZMLHVTnYK+v5+h+vbs1X1UuYAsPjieoFDQ4hLJABirBjkh0hzCnSD8Sr OfgcP3+/tvwqGnOh/MHlwSll3yCB7pLaik58++P/cZ+ALWIqBK7coCHZw77vRe/6 DEH8CV10gknvRe8goBkFfoAvhZ8mHa/Pd3BwNmZ2Jmier0dNCGpDv8FxIBwvJ2Up DCiMovU4hcwecAnuhe6Y3coCF05AfD2EaQZ6m6F+WXIP6sdoiOMCfjs3yHSALb+n Vhm0OpgTa1a1JfH1W6GVrhkly/JmupbdaFOcveK2dQmphsf5Xi5sDCjhqbCuR4DV wD4EdAmEqUOwUPn9Zx3FHBQvAoE/RM0/DU6TgvOr1EFtgSKSh4ZTbuMkIP6BP54T kC6Jvw2A4MB/MAYvLiwUDfP8F0z3O81T9AJtezj3sVrZZpMydb68seqAgPyOnkUM +8X+T7cjVouOw5Es0PkUU+zCM78APT6NY3q3y9mto4eFCFJvwt/37wrM5wvo6/97 9HNO8PdpCPV14XjGu3GR4xLhlbgyiJhi7S0ITA+hMc+YTA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2573BCCBFBBCCE88

http://decryptor.cc/2573BCCBFBBCCE88

Extracted

Path

C:\Recovery\7lj22-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 7lj22. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D4C342AF4427F0C0 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D4C342AF4427F0C0 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: ktY4HB8dWJ1eoxtMrGCnIu/GL/R+serU6a/9Uy/sx0O3oqUeYmAS3s2qzCTdDMGt cED7s+w+aaYC6vyudfhr7vCAK3JYsNW/rcEXwlG+agmAWgHowAZF1EhCrzVfDahZ NPp4hp7gKWnhooxdEUHQXHgY5vumd8QMuQENHI+vpqCkqk00YPA0tIAVIktiXkWM zaWyJ2dKdKQH9NyAMDLXFj/Ad7RMS4AmOrSA6NJYkABbtM6enskoNkuUzm/VbF2o yhk4/R7G81QVjzK8zEpcQDcpfuIqGLYWy810WtOu9O9VQINn162vG9d75rpnNqey NWL8Ev1NGryY+ovRK/0hVRGKPGP3f/g8w39eN0skKwwUbVlTiExsMBXD6sKRdxKC 5XRU+W5bakWQWQY/X6b47aDt0EK3oUlXvj7opfietN7Fk8wFmJnK5f3tMLFm34tE t+XsTpau9xDVs9gCqgFfHh5HPmBu7apkVzAlOWAJzjbfTo1LxWhSbE9w4zKRhp12 0Fjix0X3ShFedNNxWjXvZPb4qIWm1fP+XqhzxPtC14rSrngUjCdSBqj2g/Z3lXBo 9SN79yTpMRaycKNjvb53tNDXm8YpYU3fPdZUTCTSCBVOmt0LhIXQssuHdJsNDanv ki84/BZEhje4bcICrvqw7nWfq45yzgbTK4OwGTBvSaK+xa/VzlrvZyLfJRIlceIo ni2u1Na2NAWaiAGpR5GA43xakb9QFaS5l5EaItYSJl1io7hfPuzsn9oLhE3zAZ+a 3fwehJOHC2jc+UTuAUFX40v0xYMyYmifa0qWMlDHdrsfi25WV3IWJzfcLO78MHQL TMe8j50g3lRMOIScZR1ioMgpnADgIGYP1u5Rlzpu4M3iEGrePmMnyApfpBK9aIPt rd4SczdAySKsbIQDmWeemoiTu8mww4HugOkkJiByUsJ6HgOwD4AZfMHz4lpkfDl2 pr/OcadlDZnpVtBYRpEu8zLj56y43YcFA8Mdr2LINf2fuofMXyLUFL+3rOKq2OuL lzpC/mgfW9r/rFqP4HjxyfGaagBXsCa2SvJlFqEqcFcMV8WyL9FIZqhobPx0gqs4 NXcUj7z0EOmslyzu6uBb1N7MhJ9LcZcwICAJ7QMfVvPbDOUxX5qV8szEZpDZ6smU 9vrNJx72eVOeP5MojNywlrE436aeuRybMf4zxkly2lZNA73KF/VshUl0Sqts0V7D 6Oy+mp/ZNAo/gFqU3DskVtpkpg3TFuIVffxSQVjzV9iN8uqIhOoIuJy2OL0UWzvz tYHqAoWIOiwYLaOwv2z9hVpX58eAacbZBo3RrPYHW2JA4QRn8OHSjQG+m11IoOK1 ZLgpeXswmUvlC5ZOIkbvTUOX/Ewd7qFMhjiKTC+mTn/nAbAs ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D4C342AF4427F0C0

http://decryptor.cc/D4C342AF4427F0C0

Targets

    • Target

      d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95.bin

    • Size

      118KB

    • MD5

      0e285f30f30dedd812295d2408f4b84c

    • SHA1

      24e8a7a0b9fdf929e6cc4b52b0470bf4f7b6f244

    • SHA256

      d91f951bdcf35012ac6b47c28cf32ec143e4269243d8c229f6cb326fd343df95

    • SHA512

      0e89d41a5bd1389d74e661e8f9d3efedff589c2e64f444971e349436a9b6f191f0a0d6017a1e7c28d33be382600b08d00f9496ebdfcf839943d559d1a10a8503

    • SSDEEP

      1536:ac79OtHXciw8MfMNQulioPIKNpVO6OICS4AziU/U/F20rg8sNlQoaA:EXCSK4IKvXhiU/+F20EVlQTA

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks