General

  • Target

    42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d.zip

  • Size

    123KB

  • Sample

    240402-q7gzdscd82

  • MD5

    8474c41d0f20477974c9bcec65b0727c

  • SHA1

    9ce171a6680d7abc07f87397a41de2091f2e0d4a

  • SHA256

    69de11ed75d212a04e1f03206929f339d8a3f20dec5b8047adf5bb4d9e1b27c3

  • SHA512

    0a467e191f083bcb9c93df5cfae0d7f652983a534244e2fa38391eb0abfee5da97effc8b6184757ecc19d6431b2ca772d764c7071bbf804d63157e1ba9e1a82b

  • SSDEEP

    3072:kWnBhS4cV2HZGyJ2IzkHULlZxRTlUIXBO48L:9IfIzkHIZxRTlUIxOjL

Malware Config

Extracted

Family

sodinokibi

Botnet

19

Campaign

3134

Decoy

mank.de

work2live.de

triggi.de

innote.fi

iwelt.de

mdacares.com

celularity.com

wychowanieprzedszkolne.pl

bildungsunderlebnis.haus

urmasiimariiuniri.ro

devlaur.com

philippedebroca.com

kaminscy.com

boompinoy.com

webcodingstudio.com

onlybacklink.com

victoriousfestival.co.uk

levdittliv.se

rosavalamedahr.com

DupontSellsHomes.com

Attributes
  • net

    true

  • pid

    19

  • prc

    visio

    ocautoupds

    synctime

    dbeng50

    infopath

    tbirdconfig

    oracle

    winword

    firefox

    dbsnmp

    mydesktopservice

    msaccess

    xfssvccon

    sqbcoreservice

    mydesktopqos

    sql

    onenote

    outlook

    ocomm

    steam

    excel

    ocssd

    thebat

    agntsvc

    powerpnt

    thunderbird

    mspub

    isqlplussvc

    encsvc

    wordpad

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3134

  • svc

    vss

    sophos

    mepocs

    veeam

    sql

    backup

    svc$

    memtas

Extracted

Path

C:\Users\4w9181-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 4w9181. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7B2544B664CF3A9E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/7B2544B664CF3A9E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: O/dHAVlk3F+kcGtHb8zOp7AmYEOUpOoSfvmYJsIFa11NKp7kGwGPMlImqNv/BAio 8WGS4si5+9gtGAi9MxmLT8D1tKX54ddcbL8m4CMW33DWZ+jh+SSTnomQplyvaiuw K8qxWs2DBKI1EIZh0B/ITzuKTtkBoSWJLnEfaDwgXwRrMCLMB5VTula0+1q3NajT GjxwL2FgzIgo5dG+Gge1lt7th0vG/bfmmJz+lU4U9JwFOskOvnmNYGCYy12Rgk6C gMfXt8q+odVhEG8iuxXc+xosPLHV8z6mcyN/NZs0kz5IyJEA+OaN7cnZgZgqV3cP Qduq3gf0RJPhXf9OwNhY0DOaCaUtqve3qyvil+F+mHP/Gyy3UBzrnyWR03jdlMNx XjCWTnBd5Q5wf+/8pzXMojl6Pei/XK5rjabnqBrv/9qxjsW4+TuSlG8VX0RPmtkT 5TLN22WQgvMj34gq3jfbHyN4DqnT0O7fKZ2DXkABLhpVdXQtTwfUXuvyD1zYxXE2 BLLTSUoaVB+GFpYeqSZ/RHcdRDzwxXIkcuoheJfN8EL+WXV5D0HUTt6UZf/MAo3a 7Xe0PI6mkCRrCHN6ymumnUeDG+o2ac06zbg0MHxrwDtiT+lCfafqcbFoWIli0FGb lWV4WlwPraRCZVN9LGBgq9H+iHtdl8NTMvo9lpfhSFCkCi4kEgVCLcp6LSDLthaL snbcQlQm6Xo0d/lKJV05oMjOdvM8hc/DzzY/11AVuaQtpBS/5asXdnn1UaGfIyod OZY4EFGyBWTEo32Z5tQDSsxAPhE3rGyfAkmlE4l7rd2aU7THHu60+IIZjlDPmrJc ajacp7TvW27FP5LzYM+YGT5cGzEFMOXcyQMWH4ZErsUrQuhTgtkVzsq3zmktNveO +rnaflezJAdcsjGKceixJa9A1FSCRmgxsuZe/CSbx8T4ipeOKHCpimoaTHDRLzjr 2NXIuCWBr6579GrcSb/Cz3wXCLXOTMhy2IYyZ78nHjCwO4yTIPehTg2hYkutafka w71LtowyL8lDLrxcYzQOSfx3Jmp/EUTVbnhUdEM6gyuCrFECsx4oOFLfPmSKhGGE Z/0zxeG7ehK56Gz/H7Btk4vufSJ13tV9+IX9r9E5ENr6wSd+6Abcpo/Cy05iHM1R uUhaH0uY8WOU3necprvGScVLE3dBPn5rzmsxN0r9wEBp7FLLxmgzR6thDqDgP3I4 Hr7pIa8tQrq+PsJT ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7B2544B664CF3A9E

http://decryptor.cc/7B2544B664CF3A9E

Extracted

Path

C:\Recovery\wpq2m-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wpq2m. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/884E796F59D57ABB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/884E796F59D57ABB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2dpDZ78zX2b2dvXF5iWHoEvyOESk/bXR0+DRWfyYP9sTjfX7lLz8rH7blNuZ6mXv vH6FmLTxOMLggPOCcqNqfOGqLw1f+4S7PnDTOjq1a7rNXPjteyeX9QWuXuB2f5vA C+NUE3fpL6CM/x5aqVl0MXFHRQpiPUxQp5cioCcqoJy5PqU8rusNkBTggoAmSsKT TYAUduGYSpd9c9pHJTuMkmYnAenMkloYZw5SRAqg4vrdlc26/CTXEmBcYcWr+ZVF sYJCByfYKdzRqqk4X078F/XHaOFTn1MaDO3ScMBmj+RvP7maOZRtbjPOeXOdxpWg zfI5mZA54ncUVNzGrDXiinC4n4PgVsUPdgJUoZHvnZEGi5oUajoR7tIAxI7a+N8V Fzg+c3EywiANv4Mcq3MBlEhxe97AWq6CacwYzgJSBhFiNbHKMLNfRImihG2mbumV VzsTzYSiw3NBtSNfkt6H8reCduE05B++vS1Erjh/LAPEofN6qURU/Dt7XZiaTCrX ETvkotiJAGGoGW/jHjnPa/ePR6jqXKJjMYVcN7i/mhqgYz2aRv2eG8wDbZ7rVrsX qrlj/0/xqXx+QAU6CqNPN5TvokTMyrtcJtO7uQ/Qu+XR4CsJKXc/+Az+f5QmUB1K RqcLIHddDzUPryWrvxMo0JSiYhH3ibUHijcfX8P9uNB41YU18TVuhaHwSXV31vKB ET8A4YdKQ/6VwCmRaklnSgjuiBEl2eWDEIUV/ZuOIlMZrC2lN6hapy1e63VV+mQW PRD9qK8lVFVS1N/zSg7PjLAjHpFbe5CG9GAHHaePMoyrI/VDsZI3JaOnmKwPRiIG pp3O+aO4BO8I5LqbGAgCeP/WNtqBFVopjwab6De9ihlpsRnn2rGEfZq7Dld+4bGB skm+3dTn8yev3l8RRQeBDBKWXExXJV9g4PnvzhKVP0pduIusmqUz4QfaFQSlorkK TAFK3IIRi0WW6qvfd9CylS6fJJsFAHXKVBI4V6/66Trv7tEYlmgcUAtbdpP9ZnXg I5mcfzvHD7lj8GzTgC9HiYCakai5CPLXH6uNMd+c4/CvJt4NJMMJKj6KpoGwQtWh 1KpTt02NY/q43PKu9nyOyHWncxeMMnU7Ubk4cTxJEo7XtNyLNaxqAg3LRYtwqHVA eUm2JEexb0z4/3WiEgUKnPNdvS3+10ii9IQqS+cdJvXHX8M2NzHYJb51iTDGP8zH ctddrsTd+IyXjKzr0xTCRA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/884E796F59D57ABB

http://decryptor.cc/884E796F59D57ABB

Targets

    • Target

      42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d.exe

    • Size

      166KB

    • MD5

      43e9093ffc8dd69985a9ae65b26f5551

    • SHA1

      7b268ff84e824ddcd8b7df3cf9993be012489d01

    • SHA256

      42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d

    • SHA512

      118d879750d0456f5b2e31818815ef9465fb40eac24f4784236c626d2a2e753b5a85ec5b2c66a755b10855c9caaf77bd85b6b3d1fc7003fb029cb703ead9037c

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QG9BEJfMt0H:ZJ0BXScFy2RsQJ8zgG9jt0

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks