General

  • Target

    15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.bin

  • Size

    160KB

  • Sample

    240501-kqh78sde96

  • MD5

    b572a0486274ee9c0ba816c1b91b87c7

  • SHA1

    43a904323a8583203b307c622c71c8ca706c2462

  • SHA256

    15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b

  • SHA512

    77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171

  • SSDEEP

    3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg

Malware Config

Extracted

Family

sodinokibi

Botnet

15

Campaign

19

Decoy

augen-praxisklinik-rostock.de

pokemonturkiye.com

mindsparkescape.com

relevantonline.eu

kdbrh.com

ahgarage.com

rarefoods.ro

lollachiro.com

drvoip.com

rino-gmbh.com

powershell.su

eyedoctordallas.com

riffenmattgarage.ch

signamedia.de

ocduiblog.com

kellengatton.com

salonlamar.nl

nourella.com

birthplacemag.com

2020hindsight.info

Attributes
  • net

    true

  • pid

    15

  • prc

    mysql.exe

  • ransom_oneliner

    Image text

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    19

Extracted

Path

C:\Recovery\dq0q64i7-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion dq0q64i7. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E4F63D30C210790F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/E4F63D30C210790F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: g/rqEFI9Srvpy0xO5HvzZ/r4UWBX50IDnUVJfo/8gP3C2qz9z/P5dXvfSreI4XAp ooBXGZ/0fWQpPAfN+13qSALWMu8Zd+qaAGotiJCK2enEJ15MpC5S3ocg+LC8XCNk xjTY8bcEa+n6gvvl7XX0BJj4Gu0kQO/JB0JTkyU0qkWVxqdFwaQEXGrBpCTnpxOL tsb/AgRiBnHHd4f1KqXeToFpkwBUNmwZjXOfBRr+GrDwUwt9k/UDLXSs2fZZwRCy 3kvSrwbtrWYlpcJN3gjEd4m/V9Np9cBQdnlttjUBSMd/+z5TWD3JzcqsrTzRthBT BhZllOKC7TElFdI6J6HrRshi+pnMV++hJVsC6lrdJx3+3Lr3nd6TRfZorXNHO6zv cih7CSebYPOAit5LVUVi05ESmxU+sr701CQiVKyMBuBVbzPkxahYKrTMyXQL6or1 TMmL87DdILvXMVfeuVvrH8Wxqa4ufg7GmAshndzEiT+TppqINp5Yq+BGOLzEoF4k c7FBXEJewmD0pCGv2ufC1wupcFdeHojj7MXaIWNHONSg0cPntHkESZaInj4MYsOG TGvU99f+auqfkuYugMsGqDj2qOkZPTBoQdHXoCYBlp6ooIie/B3GgxPyPNnAciSS D7ulSEv5+XU+8ExCNZ5EolQhQOnvGELqoZFwEg0jNDKe/DgQ9SnwniE2ufD+lvQI 4xcYqBkLfnMOabWl7mnFB9K9ly3QN5A4L9mlJQnoFJzuXur3zeXTTXqqBdEGDRzG riVVrYNUuxuhWusqxKqSR6zXe1vU5q+mzA4LTOeWko8a/MtuSsfMBZT4iZU4R9jw 4jfOWzCcR92708Wf3FVmgBFzDFqMF9byiU8Jpv4tJK1UOkkDcoODDwJBidX7ahyZ yurrsXBVB9dY3L1U7JXXXVbiTEkmiufreeNd32o8WbV9SCqch5NcGvzALK3lqxi4 1JZI2L58ORHSMBk1Jm976yJG0p4gQ34i5aMvpzKM9awzFJfOxsHQ58l4tNiCiCxH Uh4f7WT24Isy/lnzLnNs/wt50ReziDbnFEBsF+NflZQUHL3Tu2/60Q/alBYBTuqv JWj4lDBEyMpbaEqBaNJFjp5vBqGOFEZdfwqusKcmPnIzgOo/0WR6xsXY01CWWYaF s4dxckwh5CBuuKcRQCob2y9fELlAHI3ns6bpOM4sHJUA0PqxN0dGID7dOpuEaSPy +0Tooe7/QV6otI+f Extension name: dq0q64i7 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E4F63D30C210790F

http://decryptor.top/E4F63D30C210790F

Extracted

Path

C:\Recovery\7qwphb-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 7qwphb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4F4293E8E474DD91 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/4F4293E8E474DD91 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: IMCkI1K6OtGvm2n4VcSskiB+ZYIpJdTKauWMjFSaOTizgRpZL/YohjsSKEaq+yfJ W1fZg7u5f8J0/4FEc7DH7JJCfVQKmA9voc1EsokEbt0BI1GICmDr+0eVLSw/WVam abZjv2alaP1WdQ0Bmh8gQBsVREIizbmliGQPuQQ9P4iIa7gV61/x7rAJTBtSSfx/ Qn9XogUufFEfBZ+vzw2CODwBrVgRXtlT1ZSbq5mz1ZSCs704gGp3Q6UBDFYQeE+r ct0zteWAkHWJQEQOk9mrMlfiJYdVgWd1ovwdGpRAhk9o84zWsjxTX5hNHho0i3MV 8i2tsukq/zkfDnLrh3ODMQ5bV9XKBFTahimoT1YHSg3m631SJd8FcTT2EKEzq4/G vUOSuGx47oATJoE2MZ7t7Whi0Sdr1yt2sxE8C5J6ZFh8ZEo/Le/mw6mgvdgj66t9 XIH4VjL9hRDw3DR/mdqkth3vo5JoDPK3RuTb3E95BDho006bVAPdSAMYCaKoupzK DqY6cjzzQ2wAVH/ZqpicvEVjjJmoLzjeQOkP7g5VYrJdtF5YeSZ2ZckmMaL+pg72 bnt/tLAcj1TaXbltmpYKPCv0SaurgBTMdqQzqpxyCrXNoWPWjY3pT8+GN1IsOKUe bjMy4du92VjdMUHNhL4ZCE9RrXyxQiJw0sxOyGquEjQNqU+B0swAmmKOqoQyE+Dc /AZfKAfWWftC18dEBuAyXL2hz/3LDXJqs839LuiFKnjScN/jUiJTkhn31jsJxQsF WkcWTtj47U4pxN31074A1XixQ20yiYciBSnQPIx8imnnjrPlt5ty/r9pEZQiX41L pOqkg069bdSS9l7FOi7ePZdFYaTltVZ9an+Ba2yC/Whj0YgDOlN6wFeHniZGuKDH oi3gTepHHS5ejXOM5sYZqFWJ8k8Pe7Sm+vST5OxtInHzM+yWVj5Ux72LLh4op1X4 EAFzMsIfoGkoTr38caQkH4WBDE8Oa1eGHVGZ2joDDaHtEVOrLtWaqis2BUeaTYZQ uCOomG1RD7VIMYcKmr8AVh22rBO8qp78R0a/nd5jWVqLJr93/UtlHiuULWrZkxY3 C9vcsQyX9ZXpIcE5mbWGEAskSbWw59Mzbk6LTD9vF1/6eyAE/FqPTIxKt7f/QrNQ kBwKoCJC5V+CiVv/bYxZSk5sCVizS1qMw02EEEHfuy0oGX4xdiPIVKMceD+vfoQy 2GsVvPBOJFGKit/8FEI= Extension name: 7qwphb ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/4F4293E8E474DD91

http://decryptor.top/4F4293E8E474DD91

Targets

    • Target

      15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b.bin

    • Size

      160KB

    • MD5

      b572a0486274ee9c0ba816c1b91b87c7

    • SHA1

      43a904323a8583203b307c622c71c8ca706c2462

    • SHA256

      15ef2d6ef402a46165be39d9dbc0081cf28ebca0f407306dd80ac3a73a32c07b

    • SHA512

      77d4ee400ded4b4be92da0170e7d2c197c312089429a1650e2843d0ceb15402d14f7e4fc3c2e84f20eeaa24995f0814c2106a37fc4cc32de7dbb4c15b6c5a171

    • SSDEEP

      3072:tp5SexkWi1Lbi4eTMlwDCnu/qjUt7ptQJS+s:HvGWwbnWJ/3tTQg

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Defacement

1
T1491

Tasks