General

  • Target

    2024-03-07_57bb226213f038b7fd016ab0463632df_revil

  • Size

    118KB

  • Sample

    240307-a4glfsdd2y

  • MD5

    57bb226213f038b7fd016ab0463632df

  • SHA1

    a19d79621b327e1a6b6010b73e5f96cbea895d43

  • SHA256

    c7f7ed131d7b0759910ec04e5f25f0fa4f23b89f768fca1ffbffcfa130813a93

  • SHA512

    cd679c07da96c88a071f5a27825333159b257be5e49ae5852395b225a3bddf81d7d24592c9270e583a0f115f9955d332f97814806fb53573ec869569568afd85

  • SSDEEP

    1536:6xryLRras2vlBmcJW6Xi5wBwBpaKj2dICS4ARoGjnmFxVd0dEtr0kJBhnv:+dBVJW0BwjX/o9xVSAIkjhnv

Malware Config

Extracted

Path

C:\Recovery\5b7985c2-d100-11ee-bb00-c695cbc44580\wwyhp-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wwyhp. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 200 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Audit - Strategic sourcing - Management - projects, plans - Personal Data - Banking data - WE DOWNLOADED DATA FROM ALL YOUR DOMAINS And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DB30F55E04B68613 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/DB30F55E04B68613 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: L78Nnto9bFa5Fp41KaWZTzWFu9g6qE2b7eaLknj7s/LTrT6Akwi7BetuAuhsnEIm vl/YbCGDS4K/B2eJDHFglS+F/HrooyKPQkdsv8KJ5bgVkAldvQTINePYRWZ3Co3r Y2qsUSR8vaFvwYcpuj81BXmA6a9khQbmpcooca9vbDqGt1ej7PA6mB1i9H+3+3GA Zfspwo7+Sd5mtRMEnjHHPTElz5m6DKJ8Mtn7EZxY0CNdMOsVeoMtA+K/yjJlCNq5 2q29QCP+ugWzITVhAS/gf42pGKMBueXoG3d75z6yFhK+R+IULy3La34vt9bJVCRV gfeKl+0SuVTepdU6vzQQrkWoGp/2n+Zt8ZOjeeXLg4Jnmpi0suRzIor3y2OPlj3U RctftTIomgf0vb02DaBHhklM/VO4WPo6VzMKAF4FtPBzM8Ahfr1/JUKfuQ4W/iPu y0EJySf22FKORGZ2IjKnA0g+mnDEpmxObFhZInQnZl3IGzxRP5uxwVyF6sxdybv8 FQVFdQLB4I4a3tsAf3+4eWDM0PWkmSLqg/Ya0kICrLAW9nX5FuAmeqpyqf/Q76yP Gi7+uJmLC4GcKegz+RRdDChj5MHskeEqqBBr89aMefzzPCP8ZJ5L/Mayqq+sSw5O z8oo93VXComQZSutrk56ZJMRxwkUWMSJnLNdY090NMfGzPUz2y2Xj8edqvy30PXw d2tRrol51W43KthSFEcHbziRmVktRJ65a0nEf2p95FSwO2S/EJh/Cn2pZ4PnWpps 6OGnD3371FFXcTs1qgxrUMhdv4B9PtYfnCFw1L9Ek77UBhoL5qDucLdTBbjUJYNO 1JMsrZJC6oKkZ3lNubusFspMHlfWStXpAEbt1ESVbM6QmkvPL2Qdn/XD1EnU8ZLE fwnh450VDkNIvgZKHH9AhxE3gEH6YrV3T8782cmLq1DTOvSLPa6IPsAvh4LRaSEe ib3Xt0rQiwQ32GHXdn0xcU34fjbnspCUX7QbfirP+rLbElMd+QoMRvrZteFI3nx9 2xNkzFbHvPxm+auOz3OdPpl7WBkD8pdxBeI2IWK1GmQJrXQ6Bg4OLEAbpo87PzNc PxJPLpQteqD9BU8q1g6bXM6iDQW3zmnJVNw1KAJKrYSv03f69oJb9DSj70s/YSCc Ti7QoyJmOzgm/Dla3qo9noJpUOocJJtZVi4bQbuAoM44wZWeGywQxmcW/B84lV1X ASlpPhayNLtc80S/D0N2WskwkMOoTfNjJ8rAaSyk4RBSGKIH7urnO433Qp/dpC2w NNgyPqZPRfEpxJSoyQ8OBiXTW+PQE5ZOgLoHYWDJqKk5BdAUYbgsqhEyyIrhHC0+ xR0KiSHNYIdYdtOtN+d4/1+zhmJ0AzaBP9Oj4tZc ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/DB30F55E04B68613

http://decryptor.cc/DB30F55E04B68613

Extracted

Path

C:\Recovery\WindowsRE\28rm8aq4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 28rm8aq4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 200 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Audit - Strategic sourcing - Management - projects, plans - Personal Data - Banking data - WE DOWNLOADED DATA FROM ALL YOUR DOMAINS And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7BA1E3302E49149D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7BA1E3302E49149D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: HwgPAf8/zWO4TsxLBn/QmuYkk7m4XPiz0mtvKYgkU71JUU1WOY8qkuMOwaq/umqt x6YlZQXPZQNhavMigXEF52kLeYg5xs9vjViALMGXEv3tKY281iO2Y6qjhcutFUVl ZBVgyYKqBH4ck5bk+6miL0ImWgKYjhDfc1jOEoSxiu/AKwH60D/4S583s1lZP69g fm0pxx/NUQBd6K79Sao+lggLftFT1VDuA6NuHu8isbNKhW6xWVp8Ej3JRJnPKJyS TMvVeUJGdQ9Uz/4ZTVhC1NaTbDS5t26CfYBhbURt6CrU+jhWqpxjfwcFVIYnv2Tj 9NJdxxA22lvpgP6JUO85D/6LW3SPECoe3y5EuCmMyPmNOT7wawGtiwdrF5FWcAeK Vyu3r5Jg6lHVoSkbZ5sS45vflLKfgfG8fOQvf7qK3cED44jEDkD4ds0zatbx/LsE JQdQmWVF1GVQ+0OCWkI1B4HYW7j6F9sVCTT9BPf8xnaV1nqa6qSeEALmTHqxFbQF CUm6/l1/TbHIxQ1jlo4SjrFmnwkfUGwrkZII8HWLqVQMGwuaac/0a44HNsrfmuCJ F9gnn56XoZerbHDfEpee2GJD/tad6bZVF0/cr//QYwpbkupEr/pPUjRcikfYc2TU Qb6/pGkMLd9RZcP3gRuYlA7zyS1GAvzINx75UIomspVf3CA+gSpHEntIARTg9+Tq +YMaCt9ywhJdV2/5TvE9Zc5+1n0qkZ3UQNGApYF/Sy4zsJPKV0LEJu9LSldlH2KJ EmKtx9hyBCDzvJTB+LQ7FMw1/DAn9mRgcIeejCoG1cFnBOt49nOCnA5++Hkr4aYB TYD2Elvue6Td3S7BUrQtZ7eWddmKwQ/KdoJstbUkPdU8cWVJmYiPmebVvTgDv6LR vPu1S+RXke/8IldUnBDtMFcZmcilDpYHybgGUJDvSp9X2VRCAGVVRoFbvz26lZz0 uDuSui5qeNSZbDG/YYzROwnM6yGpkHEre0VNhN/v0lidwrZQIobqrTtEHSw1xba8 IkjlfT7L+Lo+yc+/l9xWtIZ5Ek1ZlCnN5JO1GbsRZnVPjLZf/pQQFeF0bhZDTM32 tEWIQt/7JKkDlG8zzV9dqxLWCrUV3iBS83TG8c5pB74NRq+EpXz9V6vMx+A1vb8t dZWdPQXKiG824EUwrerg9obSwmN6XIsyVJ2LhDdh0uXx1zeFtVNXWk2cXNaU8zcx R65GILfZKFYzTlwDMmgj5Uooa+a3EWoizDDkuZxtqiAgR087qszVM4zLAwa74zX5 pnML8N3zOKnPIQ/YRtzfGbiSYwot0J/pWzLObxJEBojdvSoldYrKU3Q4bOqvbpvZ klwqWmIm8UCYttDW9qn+ihvEEJXWSUgrdX1rv/q0gWpyXWV0HR/f9UeM ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7BA1E3302E49149D

http://decryptor.cc/7BA1E3302E49149D

Targets

    • Target

      2024-03-07_57bb226213f038b7fd016ab0463632df_revil

    • Size

      118KB

    • MD5

      57bb226213f038b7fd016ab0463632df

    • SHA1

      a19d79621b327e1a6b6010b73e5f96cbea895d43

    • SHA256

      c7f7ed131d7b0759910ec04e5f25f0fa4f23b89f768fca1ffbffcfa130813a93

    • SHA512

      cd679c07da96c88a071f5a27825333159b257be5e49ae5852395b225a3bddf81d7d24592c9270e583a0f115f9955d332f97814806fb53573ec869569568afd85

    • SSDEEP

      1536:6xryLRras2vlBmcJW6Xi5wBwBpaKj2dICS4ARoGjnmFxVd0dEtr0kJBhnv:+dBVJW0BwjX/o9xVSAIkjhnv

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks