General

  • Target

    6ea5e00f7cca5e9d0bece4b71b0fc0ad32973e80d409be32adee99da5b9c98fd

  • Size

    118KB

  • Sample

    240417-p6rxjahf6x

  • MD5

    6f0a686291633dae6541919d5473512b

  • SHA1

    b513d7a40cef2aaa1cfd8aa2677726d9ee0d3f3f

  • SHA256

    6ea5e00f7cca5e9d0bece4b71b0fc0ad32973e80d409be32adee99da5b9c98fd

  • SHA512

    62612d9d750a4a62bcbf77462d8c1a00f17228bf02fdff0fa14d96390e5fc47c191e14db2ec92a36ce4dcc0d5bf4a4ebf3059fdb87e65bc76e0c46716bd49202

  • SSDEEP

    3072:k1p30R+mAA/9S4QwUqxNwZ39Fl28Mh3a5+zhQUbW1g:ORobpNkqMfFgfI4zGCwg

Malware Config

Extracted

Family

sodinokibi

Botnet

38

Campaign

379

Decoy

noda.com.ua

ijsselbeton.nl

broccolisoep.nl

fsbforsale.com

mrkluttz.com

berdonllp.com

ox-home.com

internalresults.com

kdbrh.com

goddardleadership.org

o2o-academy.com

fbmagazine.ru

toranjtuition.org

site.markkit.com.br

tesisatonarim.com

mundo-pieces-auto.fr

egpu.fr

rossomattonecase.it

fotoeditores.com

awaisghauri.com

Attributes
  • net

    false

  • pid

    38

  • prc

    winword

    ocssd

    mydesktopservice

    sqlagent

    sqlwriter

    ocomm

    thebat64

    dbsnmp

    msftesql

    mysqld_nt

    sqbcoreservice

    visio

    encsvc

    steam

    sqlbrowser

    tbirdconfig

    mysqld_opt

    mspub

    sqlservr

    ocautoupds

    synctime

    outlook

    agntsvc

    mydesktopqos

    xfssvccon

    onenote

    thunderbird

    powerpnt

    mysqld

    isqlplussvc

    firefoxconfig

    infopath

    wordpad

    excel

    msaccess

    thebat

    dbeng50

    oracle

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    379

  • svc

    svc$

    veeam

    memtas

    mepocs

    backup

    sophos

    sql

    vss

Extracted

Path

C:\Users\b5lv515-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion b5lv515. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/37A47D4DB796ADB2 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/37A47D4DB796ADB2 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1WXTB40e/IlSno2Xf/bqdaUsEF9oRd4ikGabYYWIc81ybuoWU8RQ/i7BPd5qis4R zkiJSxutXP23d8beS8yK/aQQOR5iaaqvG/HplCSvEhx+7k/gw62DO+WWootQhX3O bJ8CZImZuz2dbqp6tmrY776djk/8C39n0w7JCmsU+0XdT+g7HeJOUw+EJ9J8fOKI 8Jg0Cu6O7u/tHEwFL5x/neinyojKUr3AmBprMulVIY6at/Xc2cVt0RME3WqFk2cF XmWL05yywVabVKHIiEWuSjmRpbDn1WD2lVU2+8VAvOKQE8sC/BSUomvdq3qT67zs GsWDn9CwqciUOPlMpbgxaHpk84N5RTOrI4rQJIBkE69x3pxvkzoepPiyUMIBshct VvB2ufYSOWNd4jo9uEhj4iKNNjEEeQ9unO4yOdh3dMN+6yJ3xgDzdfAR0hVhIA5+ QqNyxLuKH10jlC+XuNSt8QnMI6fhIscPbjb4N1gHOsUJKsUH8eNVLUaHpZoEl3Ao waT6auWzU7SGnE8WWA6sZy4ih31NMgNE/KyIe+oyQKKsJQ3n6M5tckzQKDU5hhQh XNvuBtm6oGNqHh0IXfjFQJ87Ca51XHCM73tE7WZlci1o5gu5a6Oz/MQeEeOigjee EPWIzA7g30AtzqPEGeNV1bajWC5mI/Gl5mq/5UStk76EqkGfNnuaLj13fHSbiLUQ uXftk2NIYGu0eCo/+LummpRDsr838sFWZXMSt/rjqm/8a93C+xogu+zBgq25TJqb LyMQGrkWP9L4MAQ1/wRLi6rqysvJ5JZaYSDUx+Y8phEVQnVCOFfPiX2vOi9FdI2A ZmCE/8yqvoJSkEPuj79PxCSqc2ArsLs+czH2u11HiKkYmVsIWqwunPH9lcdY43Wi Jk4UVsA7+9CB6eATJToNEM2Y11nsGKa2CjmPj1WrDJ+B6x64vAq6q6l9ZGrZtZ8O yKZbyei7HunK2Xqy/ar9KNnuruR6z4YHZQ1AIeQ5BunPn2szNNp6+eOPMcSXq5I2 Ufi19v6lc3Wux6rxMe0kOuVwJ2eSwiVoGXGlwaTFiM+WmuoAd922/rsgAFszLfMB yPOSi3zHh7xDDeV5uySZGte5zXaqS4frXzQ5v40HN00CWskYwQdHGG43hM0CmxUR BqRUyj4IJP0d+JoVY4y9z1lKgJrPMIWSXT5ZRn06L7arfhiXIKCvEycQzksUBDLH Ug0C9X4K92Saj/C+ Extension name: b5lv515 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/37A47D4DB796ADB2

http://decryptor.top/37A47D4DB796ADB2

Extracted

Path

C:\Users\oyt83c-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion oyt83c. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7B23E66EAD31C10A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7B23E66EAD31C10A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: QubQWmY1Yeci+iKetu/qh2ei1Ql0wfN48MXLJmlVQ0jOnw2BN1QGa3jGz0WI3Vsf qQBRGg/CuXUH/ZWckkEEJIJMneX64MezP7JJLp+9H48MO7YobelRLMcLAE4Ydr+n CkwJp0/ofz0AWXJvZ0VFC4VUxwAkUCUm1xoLB07LTbi5L8NScvOTbmbeek0Bnr3m 7sNqguh4MN5ia3ZM79EWQtCuZeiEOM7y69yx00p/KF5tjISWbcuNtJfzRWXSSA4E geAve2GoTdGKfRA3Ji8W8slsHTwRboNc+MlnJ6ejXBHF8AMXbQEIuvo5stSJD1w/ qkijaayYCfVoJmupgOygZxf3c2JGzlMB+Xziq6Zk+FGvcxTcC4eHNjRQV9ZNazG/ VYnG8yy7UVGr4W8NzehgTvvkJx50C1C4zGuk8yre1NgdmqeYOsyU9FDaK/O5jn9M aDyKemXwxzmnHdzmkY198TXcnEMvViI1Fgnvwd8zevRyQ9exSVPuClsJkcmoKDf/ BxipNfo0maYrye+K/6xoVIf0bYFna2iWXb0QlS8UB+9PwV7njDrA9WDq5NuPvtNd jviJ/hH72q2vdNNy8nQu7MP87+hI4Cy4jT/ctbFM+fjO6Qy/SfL0prNpnqEN7T7L IJLR2Et5kTRFrrp3O2tcQ5+4YmYhmvlAPCI5HsUqh8Lbb+dikX0igyh8YsT5p271 Tgb2NtcQhQGQ59FA80uZTx6s3+jhoVu4tuz+dCTcHbgDKNjR4jVKKOIXVr0zmRoT mdvJESpxXfTxLUcRcarLhdUmcrvOHsY98NDvt68AJs8xRAQNetJXX7MP06/gLkBu ncKBWus/Idj2XGQ+2wnwPRVdOCO+K5BBDAeARZAMOlSMNFikGkgnh+Qzp3HvogOl cR5mYv5GSYv/bsRjJrk/UYry6HX60LmE5twTfZP5+baCYz6OEpHfFM9d2FM+Dk5Q 9jRokitTm6R/+BMTNINyX9j/QwVhzBeAZq+Jkj0HqNqt1cOTpepkivrsiEVVZAdp WmLjoEdyC5oz6vEDayy8RzoJ9LAmfZB8tCclFKzzKZftwD1BZ5dobyaOtugAYgDW N9QMX976GFPCe7x7qurD62pl2LWpOoYYXKUiyCT4I8H6oQUqbvUvzG+oWw05VCjX SbGT8/HxAOgZoIcSOvTv0YYHCOn0kf/OD8i+VKoYmXvcMwvg+5zZmTm4hlaH8Yln qHxqNKZ4k9JfXp+82te4yg== Extension name: oyt83c ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7B23E66EAD31C10A

http://decryptor.top/7B23E66EAD31C10A

Targets

    • Target

      5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe

    • Size

      164KB

    • MD5

      17d54fde8f0dca439f4c32a02598e382

    • SHA1

      5eb54861db41b62e9fa296f703f06b8e52d1941d

    • SHA256

      5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c

    • SHA512

      09473f8ad9cd0d614d4a6fed4f7c34bba89f4a3e8cd0a350870e716b1f499d0d99f25ea436b13512094bf2f56178d5f9ffa8c74ad125c4c61e6aaba7b2a814b5

    • SSDEEP

      3072:ffYWjswg4fQlt4ndm8jX5IXzs+M9VQHDOVFI0kmit3:ffYWAw9fcUdmwIXo+M9VQHDlZmit

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks