General

  • Target

    2024-03-13_f8f4c6567cae72fd9104fc3135b21bc0_revil

  • Size

    123KB

  • Sample

    240313-l2r5ysce57

  • MD5

    f8f4c6567cae72fd9104fc3135b21bc0

  • SHA1

    979551d09ade2314cd4695703aec787bebe30be8

  • SHA256

    66cce1e548b279bce05e78eaa2abbb8308cdcaee5bb6ee7de6fff5a154285c0d

  • SHA512

    c10ba8320583d9ef3683574950d31381c3ea8cbe2e84b6de071e9bddc4f77430457b0b932924ed13279fd022eac259da3b5c5d6f5bf4de308e2edc05add602b4

  • SSDEEP

    1536:7DvcP3/ThpshwVs5OE8yNcYQp+2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOx5:ysSVhaNcYM8gnBR5uiV1UvQFOx5

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.

Campaign

4085

Decoy

sandd.nl

digivod.de

southeasternacademyofprosthodontics.org

resortmtn.com

mdk-mediadesign.de

tetinfo.in

fayrecreations.com

ecpmedia.vn

physiofischer.de

highlinesouthasc.com

antenanavi.com

blog.solutionsarchitect.guru

deepsouthclothingcompany.com

coursio.com

quickyfunds.com

atmos-show.com

pawsuppetlovers.com

hokagestore.com

midmohandyman.com

mmgdouai.fr

Attributes
  • net

    true

  • pid

    $2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.

  • prc

    sqbcoreservice

    dbsnmp

    mydesktopservice

    outlook

    ocomm

    excel

    mydesktopqos

    isqlplussvc

    onenote

    tbirdconfig

    msaccess

    encsvc

    infopath

    steam

    thebat

    agntsvc

    sql

    visio

    wordpad

    winword

    dbeng50

    powerpnt

    firefox

    xfssvccon

    mspub

    oracle

    thunderbird

    ocssd

    synctime

    ocautoupds

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4085

  • svc

    memtas

    mepocs

    backup

    sophos

    sql

    svc$

    veeam

    vss

Extracted

Path

C:\Users\36cjv3w-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 36cjv3w. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/971D7A3AF78F1F80 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/971D7A3AF78F1F80 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tjpxfaOUdALmg4LXntC6x7R7enA7+Dpt6dpO92Omhu/aHS+WxYJnJoUT5eJUFt9h kDUvZEWpwp4pwMHVlnhokp/k9kxpHiTzbJZbiFUYOgjB+xgxV5BuMlF5Xz0Xavik i0zddcnzeZxeleFmNiXu22NuxuocMSGYTNNQDNhNsxN8xb7EhdPxXQN6sqHWL/mN hsDWZOS24X3FRHI0sc3Dr+tITlNSgelS9LMCM7uTE+OLlM/g/3pNb2NsVId9onbH Cor5dwvA1HVfU1CoQwV42CvpLtI8YqXh+uCokYpWE+E61UJTyw7XFlfKxlqrt3cD ChcJxQt/lOo5sN0wNKejOXjr7dX1ci4xSLPfAsJdOg0d3u2bXYUy7B9Xr7iz4CF4 eLPKqbYrP+d9UqM1HvTUFS6J9XhjXZrfSPCfP7LVYUtnAI9qwXBLTvbT+/mO7sAF BQiaF8mAd9x8cv8bfW7PTsloSAROL2+YYrYigWmngo7LxrCBUv+R1q2iSQ61sfuh pSkKD5wV1Ju+H5q3YRl3H+YboVbgd2/1XodBpPHrAxyevor3lkdJ+MmFQ959YNeJ fcbaqgkIfN+KtHTHUBVsCVt+6dWTmiayLbx/KdgCvS4tz/p2SFG+t+hUW0qErxsQ I4a7ZZ/0FtceOjB6i2ef65xLoaLvAGNkvRu/ptPX/v1g6nry85YVJpiLnpvEcz+3 +Nkagn905bcQDsrCz2Dv2qP0bRQogaAxwjq4vJVS2RF+4Qk0B8JfJ47kU7NPb/o1 qVruTQu+k6kgZZpR+NYxwSTMnJrDe3BNgZKfk3o/oeEh72FQpL8BqALf+HzjVsJN yatq6k1FJGTLnJQf/zacApF8LkuLLEPMYIMPZelZE+SUTfOqtrfPs7NZwJ8S3636 nRmNd1a2S9fDeZxau3Tt0Re66FeuhF/MlZdLwWbFBkzs0od3uB0WD8E6YwQOQBvL Zkr9N8BRxPpgSB0dofWjXKYu/hZ4w1WZSLUu8srrueS0TdP2xKNBd7oWSz5fjUcX lARGg/fSzd4NjTDAIb2ywySWhgnqgp20UW8dlSn42nYR0JoVzrZZ4cV50bGB0O5d 7eALIl0bwU/NSkACXGl5tQQE/kUhnZ9FOgraBG95zO5x7Yn8AzfsIrzGxOWIDuBa Z9OquK83ot83/ta1MIceeLXHFnWA3LwlhMCcx2GvO1KdUsGcZg+NCqC2PxA/c8Ud 6002BDkdY7m+XU9ErsWvDD/qzUJiVZesw8Va3A7H4tQrXc1T+4Zr9RavTGpvkL7n /2S3T0pxmeV2AAwS5cWKLC/dhLBmULoCXStMG0caCgFdIPB4OjmqCMv+wMsvG/f0 AhduEK1wWHhN8MwepRPQFtgVwRqkefvD02D8WqqkypHweQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/971D7A3AF78F1F80

http://decryptor.cc/971D7A3AF78F1F80

Extracted

Path

C:\Recovery\u3q320-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension u3q320. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/39B1E5DFA73E5588 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/39B1E5DFA73E5588 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dcYtE7ORqituyuDFeuy2hD91mg5gpxUIPsxz9DYJ7s6C+MAOHiMO0ijELF5p5ePA oPxUNm/t8ZAOaRQh13bROF16fPh6VpuWNZqgZpdrpKvpKoHS+2ieYS10hs0DuPHz uIkPfCXH0adQPmfWo/hP5qJex+gx8VmDkfzeUPEFXFJJCrhL9ekFyyslJfSEaqEq KH+C5g3GSHv8wr6Olv9s9NL84ErFuL1M2SR8D0AS9FEABjqRAaYKajb/p5+3/tLF 6gNAVIPRW6Cipr+i9I1UUW1so6J5vZXuIbKY30USZIBDY6IxR6uFkhU7c9aTs1Br RqnzFGycVDIg4koOAOAQ/VWT80icb1CQnVWbBKmv+2hDSHB6od1zCRoyvqyugLEq kDLtHm6z70UHMliyp8/6mMLDnTGZffs1Q6QaygbHpUoBB4PGFq5IZYnWzcrUDC74 /AJ6ZmbKYz39aKRz3x0oNSU/xMNjQ/Ct43cdp3Fo2H2wB/+515B5GbcPcj5FcR1J hTmfY4IP+wYo7sZUi1h5yG5mqEpR40zaP0UyJfu/oEeU4hEWU5P3qL0OBv1Qpm1J WhU72CnAqX9/yWYYqxdUMJMdRz0vEM38hattVbu5GXtXZ749RSeO3hZHbFFH/Ghs zK/iyDGilZwVY2sWpuL9j+OyIPInx7VbtOQQruzy3naOwEwM495GozbTzyNJbL1s Z6oMR9dSVkGpkvVX/23g28B9zxSTmTuRqoHq0Arq9V2j3WP19W2Epysc9u8PTHCK y2wuazgSacL5lvcxj0CkIz5/9JgK/C0OJt6LhQ6YO3HswrCMDbMcekyXaMbgel+t 24Okb/1nLTOn7rkxgSGI/Sconot7IqF3lAUM377aQKXyIFXVhgWI1kIg6HZMO1NP WrqpJlvcAe5f+SVCiWhVwvQ83TtgGerJoaLpuur/Q7SLeJWvz9reIJgNjKkjVKDh dMHBbGNhdXF2LYy/2AUlIq7QNY8BZ9RoyIvdiG8wxcfYtk/iYvC6BvB4W6s1wDBD GUQhVdBQe15QPoZ2c1e8mRkTEJK2HbZlXetSxGTVDFEE8vyzrt2/9UDq47KONIfX ZIEmSLFSl/Iut9VQgVG4fsyz2UdPF4lQD9rWEP6cXFeoYq6rIeJM8f4YEkJKLhds 9wvrsFUeg3Q1v9FgRrThPtwHV2xkjAyWdjR+pcTNPDy9CG1OFOwh/rWAEaCV5SuL 7IL70wosvujZ5HltF3d+Zc0aurRA+jnX0sPJdZUnudN0EZ4mMUw4iQJz8ZNSQcNT v9TRjtW8ajbb0qmPes1ETFggTb02PbvrZCSWzAhDzHS1HmjhlFF5aEPtFeL7Rr7A nw1/DVrnkd/jtQVZ6/4ITQV/SVEWjS9D/24JBfFPaEwOZR7+VWY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/39B1E5DFA73E5588

http://decryptor.cc/39B1E5DFA73E5588

Targets

    • Target

      2024-03-13_f8f4c6567cae72fd9104fc3135b21bc0_revil

    • Size

      123KB

    • MD5

      f8f4c6567cae72fd9104fc3135b21bc0

    • SHA1

      979551d09ade2314cd4695703aec787bebe30be8

    • SHA256

      66cce1e548b279bce05e78eaa2abbb8308cdcaee5bb6ee7de6fff5a154285c0d

    • SHA512

      c10ba8320583d9ef3683574950d31381c3ea8cbe2e84b6de071e9bddc4f77430457b0b932924ed13279fd022eac259da3b5c5d6f5bf4de308e2edc05add602b4

    • SSDEEP

      1536:7DvcP3/ThpshwVs5OE8yNcYQp+2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOx5:ysSVhaNcYM8gnBR5uiV1UvQFOx5

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks