General

  • Target

    81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.zip

  • Size

    71KB

  • Sample

    240402-q7g96acd84

  • MD5

    eefd5afd58ae023abf172abab78a818c

  • SHA1

    71d0bfc93f6bf793ede56e3c076e91f85f5bf82d

  • SHA256

    f15a676fff5bbe1e42d153dd272961376c9348b0876842014f97d3640d5bf40a

  • SHA512

    b3e3e4ce84d6fc7e629ed76f3afa94be78e63f081d756d136f85c6f8ca9a5b13e0c150d8db2fd302f19ac9da26479f2d3e48289aae8fc82a7ca48c19448ee90f

  • SSDEEP

    1536:elJ/tfDfRMKfpt0nehWNMCm3wrZFvZpFShGp:MVc2YnsCmArZFh+q

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36

Campaign

3665

Decoy

1kbk.com.ua

kalkulator-oszczednosci.pl

creative-waves.co.uk

mirkoreisser.de

fotoideaymedia.es

abogados-en-alicante.es

liikelataamo.fi

klusbeter.nl

jameskibbie.com

marathonerpaolo.com

milestoneshows.com

live-con-arte.de

tinyagency.com

beautychance.se

slwgs.org

midmohandyman.com

herbayupro.com

panelsandwichmadrid.es

baronloan.org

izzi360.com

Attributes
  • net

    false

  • pid

    $2a$10$PRliCdjvILpWha0dXt26COEfG3S.LFJG/H9fqsY0uepzhaO43cC36

  • prc

    visio

    CagService

    VeeamTransportSvc

    dbsnmp

    msaccess

    bedbh

    DellSystemDetect

    encsvc

    VeeamDeploymentSvc

    steam

    mydesktopqos

    sqbcoreservice

    dbeng50

    mydesktopservice

    firefox

    outlook

    tbirdconfig

    raw_agent_svc

    ocomm

    pvlsvr

    isqlplussvc

    sql

    ocautoupds

    thunderbird

    excel

    synctime

    EnterpriseClient

    wordpad

    bengien

    vsnapvss

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3665

  • svc

    MSSQL

    VeeamTransportSvc

    CAARCUpdateSvc

    AcrSch2Svc

    bedbg

    stc_raw_agent

    sophos

    BackupExecDiveciMediaService

    BackupExecVSSProvider

    VeeamNFSSvc

    CASAD2DWebSvc

    BackupExecAgentAccelerator

    veeam

    vss

    MSSQL$

    MSExchange

    sql

    PDVFSService

    VSNAPVSS

    MVarmor64

    AcronisAgent

    ARSM

    BackupExecRPCService

    VeeamDeploymentService

    svc$

    BackupExecAgentBrowser

    MVArmor

    MSExchange$

    BackupExecJobEngine

    mepocs

Extracted

Path

C:\Users\895v7d4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 895v7d4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8FB5E2E73DC15E63 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/8FB5E2E73DC15E63 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: RQmG58L2yT21TTI+gen5uJ/MrClXxozbgbX2GkiUIPryF9zUdiBBG/KUKu/aigRG VAlUwsUU5o9MjQjDvbPYb5dbN5d7hmNI1IGx16Pha8bg56DG1ShZShFEpKi5eaN4 D7WsNPkCn6ZUuxrQxf0M+QzxmSdMI1ab3VyxjB6IKSevQofLa2ce0yYZzHi5AIDc TMk0O1FvCffxj+/m4KSEYAqVx2yba9gZAG5TCmukeKqUEEIM7R9ViR+pIC8U+ihW CxVLj6usXnt/1e/a1EJ5tbUNfsDSfPU7+6rGnlJn2AY972FlJ3HiPxDonSKJwD+H UObFebMCcJGX70zMkibSVXdBcDJh6rM59m5plTGqA+xN3Swi2IhUYthqLpM0aprR uRl4Xa1GOLDd4cPNcOi9HIRmK5YavvsYi02InUZ3dMvetlW57eM4Pz3NftWOpYGu jmkKH72hs+QCAdPNgyE8PtSrFps3uABPo4dQZy+Rb97U1b3xpu5RPaUxTkBI3+RV FwHFIMeWFWAq7eeDc/lxo41o8X92lSOQVSjYE48XtBpoPJT+JP1FIzjo87/QQePr Fh+PTDb6VPSVTOarFZs6hRcCpzQTrLPUpN0f3PimO5eEUz5ZcANFgVUTLA2//PHo hra/3WZVGQ5/4hcTsgpKdABGS/AkU6U/vlwn3C1snJzwcdrfTR9vKRDv2tcx/XYD JpYKulyKn8IP4Kyn/DHXHshzC05LB8HBAh5nOA1yOT6pc0ZVNRwKqtk+N7EhL7NY ekU2UKbOYDEyeA0YK+c2WXyytlR9beM7PjADbC6MobhWzwV39EfLICZnOIROToY9 c7qZPKomFlls2Vc9/PzsWboUl9FolNL4FpOd7fFd1bJUSXyZUjhiRQsfNOWyOQNo wLRJXgr/NPDWIOzetKenSRsMijnXUM4qR2anyRdSjOKutivV9bNzZcN858EzLNrQ 3sfUGQvbRLB1/5uTsTkAPii/TNToanoHvKiIUD2OujVJqVnTAEjEcs95/JXyCB0X o7qRI2opMiVXJU1h33t2i8/A6rn96MWZq/g+iDGbZSvYS9V8LNaZtsW3cFToViVL 9ivDfo+f1ezGrXrb/K3RppKL7U27+FyDp/krVN3YUJqia5LmlNim7Sjlm0R7IpOy uN7XHtOLnoCPam3JSjrYKIzg6RYl05PCk/CSFwT8GiLtLJRHgcFZsOKUgmHfOVsw ncmo+191JslqFPn2EK9qYP9Mn3FJ66GKAsNwJcZmsggm9zxJflSCyhz+BpKF22dq jj/ojaK9Ag94yCNqO4WwQZUx3SlAbLBIUZEYFBZXBejlKMHVV4q2jmC6UEh5ocO0 RX6J14bYb642SXeqdSgiYQgwQ71+4fE72JsNYTvJypgJgw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8FB5E2E73DC15E63

http://decryptor.cc/8FB5E2E73DC15E63

Extracted

Path

C:\Recovery\qvp4v7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome Massive Prints. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension qvp4v7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/42C0F7653787AFBE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/42C0F7653787AFBE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: AjbFMzk5kOIvFgItj/hoBL2Mc6TZq3AhCBsblkUK6vJkxu/82qUUVkoSHt3DdfL1 ZuXNok7Wy1UdAzkwxmeLsLlNRrPDwWQzGwil5NuvvDabGOECe5vRs4eKd7yWYIaa oPT89LfxTKJexHBlCThZcLMqMl1bbvKf3e/7TBtUWbwGnNqIKIAKvph3K0yGlZfh Ul/MgO3e1btaseoSuD50TCXucq+ZI03WbuPXxPmiOUDlDGxf8Ima7mDV7MnIEXRz UC0CIytaEvUS40vaJR0zLOAKghvMjdF2wMoi1SGq5WCOVVYm6p0Ee4z85nvc/UXu bN8nKCt8jlhfIWkoK6pUyn+kidELRThMC7i5ciFh8lI96OfWeM1aguNvwP9olmTr ahcQSHP+qtjYEKALgxVFgBExbCnrFX+o/PXSPgDWxP73/4svX8arK73ouLKxfYZz MNpztndhXoRAZ0cQB4la0N4K7tT6KjatmscrrOAIx+sAKL610UW825mKZYJN3/jY EUKWRT2SXSHrPQKcxOla/jEcxFZ2HyK31KyKb5GBxcHSW0CrY4i0/02yOFMzu/EC V3eNz4RK3w8Hzz3rao86h7REcnstKBsgp17YdsfAChV22exM48PHs16O8X9JAiG2 d/WFtN4aa1YZuTjb1vi+CjCpsl3TTSXBjfrQ6E5kZobAWXgPd3jJXONW0dtmCze/ bm3+ZAvaxCN8nmnF8N4MVaF60cSaZ17HsSw8FACKF8mH+FRntr46kqfUw3+Thzrv O+d+Uj+TjeCGgIdf1mbvInVvnXZUmpTVczIMmwRnd404lXt2DtF16n35ysvofuq/ OZ/flr3haNw7RmsBsxYe1TQJ6Mj/QaOkWJSWqkozdG5kcGR2Sc2NUYtRoPZkL/Pv NA/f42yMhyO6G9dFRuOoRSU+o7zY/LMA2D2ua8a6kGCeiUIBWKLxLQLQutshQTDI nj2QIjYDJXPLSIzSmahMS7z3LnIiZpPdPXU3wY2UfoGorPm2EtG1kRbM5ExnG4eb Ow54v3q3tZ6jmPpe60QZKIt54Kw/MFYIX31HAMuT7/dI3Yhu6whhGBomNS+Jr2tM creUMsnT16s7tOihW7L9PcKpqF28XevYKCkT1JOUdutu60jyHXIydJETdY5k8A3H bOJLVdUOUZ7CL3a7pDnkf1FFG1qgMPM0pKfnoMcHp4uwPg3d5Acmt8gg5FrmS+r3 r+GRw6qHxNzyldmEOycbDa5SY7+rktUomdpuFr9N5n8Gcvrre7+ZvVh5DuHquCTR bK8QDVv8aHf0wsoZo/31OVi9JDN3qyYHJXFoWHSI9LF/h4+vp7/py0O4R4Os+Lft OkBjMuuvRC6kq8PzGbcSRmNCKq42gIze4zFQmHESbl8Ys2GzcBY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/42C0F7653787AFBE

http://decryptor.cc/42C0F7653787AFBE

Targets

    • Target

      81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed.exe

    • Size

      115KB

    • MD5

      7e18b037a068c56417fb8e56aa7e49e8

    • SHA1

      f6739569a24358c8c060d7131be70712f70f36e0

    • SHA256

      81689f1be92c8fb7e94fe241441c7eb43cfb77c6d23592b0248566bd709ff2ed

    • SHA512

      d6188e5536b6e0b5c49d572e35155d633c11fd30bc8d4bf4ea87fea7196ae2f67bca364a0afaeed8209e5d4b2be0b98d81c49293d3fed95c70c8388b8387899d

    • SSDEEP

      1536:AkdeUcaK8Qz4PQIUnq5WMrAmyopACC9ICS4A0vh4NKwTNA28V5/Ogsck:mlnXEXyk7yvh4NKwTNF8V8v

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks