General

  • Target

    5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.zip

  • Size

    123KB

  • Sample

    240402-q7gzdscc4s

  • MD5

    8faf2b278aa74e781ee3b813bec24d78

  • SHA1

    91250679e20e5c8211fed6497383a9cc672c58ac

  • SHA256

    46e42d0057ba8c5af93fde464e1541ab985349bab37a64dc2ebc55bfa92d5b3e

  • SHA512

    2b8239069ff5a1d7a45e81e310f9e9e17b4deec0ff8e139bdea0dda66c09f84d0bdf4f395459ebc2af34a340fda2177e55b18115a3e63c05f3e66a58003b4b3f

  • SSDEEP

    3072:vg+k8CoKvaJq44Cy+E3xn2h3cex95abTW6LD4e7jiXtXuX/GZ:vgV8xKaz1yuce/5abTWdeoD

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$lRCppn0ag9eMlVTqFENGPedxsGGQ66IEQQ0jST1aU61VF8vI3tMr2

Campaign

3382

Decoy

siluet-decor.ru

sobreholanda.com

peterstrobos.com

alvinschwartz.wordpress.com

euro-trend.pl

launchhubl.com

parking.netgateway.eu

portoesdofarrobo.com

alysonhoward.com

transportesycementoshidalgo.es

humancondition.com

fitnessingbyjessica.com

kunze-immobilien.de

psa-sec.de

trackyourconstruction.com

victoriousfestival.co.uk

you-bysia.com.au

buymedical.biz

teresianmedia.org

slimidealherbal.com

Attributes
  • net

    true

  • pid

    $2a$10$lRCppn0ag9eMlVTqFENGPedxsGGQ66IEQQ0jST1aU61VF8vI3tMr2

  • prc

    oracle

    visio

    tbirdconfig

    sql

    mydesktopqos

    isqlplussvc

    steam

    thunderbird

    ocautoupds

    xfssvccon

    ocssd

    onenote

    ocomm

    powerpnt

    excel

    outlook

    sqbcoreservice

    dbeng50

    agntsvc

    encsvc

    synctime

    dbsnmp

    winword

    thebat

    infopath

    firefox

    wordpad

    mspub

    msaccess

    mydesktopservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3382

  • svc

    sql

    vss

    sophos

    mepocs

    svc$

    veeam

    memtas

    backup

Extracted

Path

C:\Users\r6f0232-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension r6f0232. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/104954B76B66443B 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/104954B76B66443B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: hBW0n9xw4PYIxZ7a5kASgrh37SOpZ3DyWL8zpmEJNNE32pHoJUY1cGGr5KPiiRY9 Qyz25rwhX4I/d5ksJUj+u0LRzhLw4emW6EXLQKHElssl3DT7FNe7txR9DmefcdlK B0fxEQce+J2aXXidp50VzI56o0Z+MR1UO3OI0TzkppiGFXNylkHizYxDst7abjXm c4/a47sjSTxNnaO8zQ81JdnjSbajnb9Gckq6yuf+xkn/jMKmbuP6zBDWX4NZBvTT Ud9k0AQyMpRJSbbetxX3hvVQCo88ETKOcx5zM3AXgiLCpq3yaGwPSQKd4HfNMdA2 uZdHXX2ey+8Iqof0fZzisLspRs61ZhnItUuQd2B9EMg+Aasc5gsYetHgnP+Jo4BH qp4PO6TimOUUqadNcVb2+V11rLTwMAyWhfzMP/12W4HF+C5WWjWcE/awuB90OSzD JOItU+LJfB3ER4UGcE1oZmkjJkRt0FT3SBGmllpt1/bDgOHXseDaLKxyVYhCzi+e Tw1cx/Vu9vXxxauG958bUpFc6qtv5r0Gbosvb0c0naw39RDJ6GieKJ3kd7Vnuxpl Mr3jLZ+FfwEacPwuc0JDllVyI7n8o1n/wVqWl4cPZrwr95IuX46DIR66p0e0qL9b RMMvvZ2alKv0y+ks35BInRhodWglvryJTgv0Nw1oT2vPxbtN/u4q4YSuP9ykiBgV v+tN5sWsJfy0EZKhQFro/z66y92aL2W/jM40bd6F9XArOHJm0lTa97x8O6F/t1Lg ZWe5GUUjHEgybKwkWTwITtB2JHI6tmuL5cbDEHNzfr0PJOmdSKIofVE98MBWnDBk hvkW5a6mdApr14PQ3SeH+ELFubhMlb6ClcLvdOKfBHfl7+Pi+4A4cS5RTR5TQLca zbwDkzvQHT50eZFuh+TIaQkeZqtqmYB74YTz5wWuku9Yral9J8wg4V7NN/nOSlKA ZwMlLcN6RAtqyzO9+h45JvfXLR5IyVsSaSXd9IuAYcAtiVsMXzZ14vkMVX56EzYl Av85NJ5HIhEvLiw5gsXR3ALHGKfWPHJRXGn1dJMJEXoW0XZqvz6fYJjXcnRMboEf SFaYn2a5IiolZuqw/0vPnEfBe22q4snBIQw7k6ARykXal4+00mx0Z9owfN8CTb8n PZrYh7B8huacosLkkgtpLPfgCCOSBz6u85g8QTi8L+oTv+tlt2yAZ8P8sWtPfxa/ WZUfGcDl0cnZ3mVq8hsWyoyGdHWC+6lIeb9r9j2fhKM/fHUJ6JsuNDUnecijPSr3 Xzt2DbO5ePIIs/EWEl/mtDL1IhhrTahobNn6+C43twwVFKsoiusiEc6QM6TD1vcQ /MoCY80pk+QWFpu3QztdpNhrGc8C1m9Sfw8doW6TAbFvQw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/104954B76B66443B

http://decryptor.cc/104954B76B66443B

Extracted

Path

C:\Recovery\4vli1xx-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4vli1xx. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/966F9E313980EB78 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/966F9E313980EB78 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: TNXEcDg8aySqnyIkKLzfjXcNrhwiuhHJQfM6oIb5vwHVJt/BLR0JFkc830knIG1D 0WAgSHq1TS1+aJOmX1EOjOmufTqxC9R2WBAviagT0olr8zoCnl0iDUeSJRSViUpE EE+s4NTRh7SXzU9XoLeR+4uLgHNTiPQkh4KfjMLZiueCZspAqnRvo6NtGKmup+al lDH5G9rKcStTCoNQM0kJ6CCz8PVXCGJbCulJiY7Hm53wZDwrXobig6rPwYJzQBpb ZPZ5esX9Pv+nDxkok5eNQ2b/N+GgnxXhmczzCy0LVQPajT4sIvZNnQltWc4S5CPX 5V5co7sz6OxEOD4Kcm5LaQNY9Z0qT/KfWXgBS/E36mmkiDATVpfeKYvPDB6MgtxA f+vSOXzfM7+dk8HDJGvzhwViScTW8IZI6/GBDJeEL17Eq+/9eTfir1RNfkRzMD/u zt7BoZXT+cbxIFeo/A5gYxSyRdpkf96Y30b6rlM4J3AEki2kROIL322cJCRBzDlp nvYMLEXc8Yra2gsTVd/TSkdai0/wNGAOt1qeYszSGSjHMUgzRQYz0JbDuzeOuljh NtfZ4dVX7xZ/y6lrxtZDH5abtTqy20c+Z8Dk9FcN1q7HbsCMahObgAt+ugroj/rJ D+dBAsqZBnIq6cRiwbOF+ot+7zppaY0d5PD2/09aHtcL4xcUotnhOxg2i40R2JLx uT7now8T1lYy5CST79vBGIMrhIXUK6WTqoEEDAyXf3eLYodebXY1y0eh1hpLlhEp SGbSmTq+Td2KB1WRtfaCkLWJrGHRD8W+XVwzFzX5fUloSwhgddvfdBV4kNOiF87h FAXlNXbY0WcP21iSWs2p4hAS/l71IV1sq+iHtu8rWklNK5Z0CHfsoOOkjkaRVlXf 7ktSAl6BHPnrvJGFQ2qRg3SOzyLfBj4M/4x1u+im73F2yrAlfycfKl9/7dO/unxq Gm+qfSOyHOtRU9ieLh3pQAZW/qAw1S8RfC7BWWZ082MVO9jZ7Bd47hhmFLrbeBpM DWBCErSBEhZz262Bz1jqskbatZ67wFM2VvEYwnrgbrrn9I7QvSH5R1+ZZUIR4p0o 8wGTUX1z2BTsXk80QK1pRuGCkSg/D4GIl9/dFiwEx8aua2F0b5W5grsXZQfuxDbQ b2DGkg8ew9xCQFwG9/yWVlL3+xAhJeSZcOMoPkG2cFBcuLqE767j3CNjdByXEZUN mp/SpP1SwlQvqgXVIu8HgCPCJWXw63mNiSBdv5Xgfp9emBdffWaijAEfc8giI7VD 1KJVwzMY5NH8Ab9WaFiAcl8n+HI52r2NY8VtxOeDFOnp7BrLw9MSE6rFH7qNfEUe mda6bJnpTTFtImrELQUcaT3A9FqJdXz/WSF+JQExVznDp0nNhqcVhA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/966F9E313980EB78

http://decryptor.cc/966F9E313980EB78

Targets

    • Target

      5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe

    • Size

      166KB

    • MD5

      8cbc25e4d5c3dd1ee950c9eaaa67049d

    • SHA1

      2e3bc332df0adf7b9aaffad3e91d55463c858fd4

    • SHA256

      5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6

    • SHA512

      ea5326a5535995aa6a6754e3cc24096a8d27a23eed9bcbcf8849e59e9d341eaf7022c0524a5d15ccdb0405dcabe43d18f8587d12c79b4bfb50211ed7d51dd97e

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QZcl+UNO:ZJ0BXScFy2RsQJ8zgZcl+U

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks