General

  • Target

    13d4c1451da6fa284c08c669a7d0e7c1_JaffaCakes118

  • Size

    164KB

  • Sample

    240504-wgvepadc9w

  • MD5

    13d4c1451da6fa284c08c669a7d0e7c1

  • SHA1

    2ea65287c7489d8ab5abd04e172c55d1518a4052

  • SHA256

    df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07

  • SHA512

    f845335dd84b5bf9b20889dfd051bf012dfcf96adaf4f6de171b3a8e62f42cf03c0e18314ad6ca59ff3eb5e1c0ef3dce179845aac6582b9438c0b13809f47554

  • SSDEEP

    3072:ffYWjswg4fQlt4ndm8jX5IXzs+M9VQHDO9KR/vOst3b:ffYWAw9fcUdmwIXo+M9VQHDxmst

Malware Config

Extracted

Family

sodinokibi

Botnet

6

Campaign

1402

Decoy

vvego.com

catering.com

animalfood-online.de

mazzaropi.com.br

agenceassemble.fr

anchelor.com

duthler.nl

druktemakersheerenveen.nl

smartercashsystem.com

slotenmakerszwijndrecht.nl

ijsselbeton.nl

azloans.com

makingmillionaires.net

hnkns.com

elliemaccreative.wordpress.com

forskolinslimeffect.net

precisetemp.com

mazift.dk

selected-minds.de

agora-collectivites.com

Attributes
  • net

    true

  • pid

    6

  • prc

    veeam

    .*Tomcat.*

    .*DogGuard.*

    .*SafeDog.*

    svc$

    .*backup.*

    memtas

    vss

    .*Firebird.*

    .*firebird.*

    .*SQL.*

    sql

    .*kavfs.*

    sophos

    .*Alert.*

    .*cbService.*

    .*klnagent.*

    .*Sage.*

    .*Mongo.*

    mepocs

    .*tomcat.*

    .*Backup.*

    backup

    .*postgres.*

    .*cbVSCService.*

    .*Sql.*

    .*Notifier.*

    Apache

    .*Postgres.*

    .*alert.*

    nginx

    .*sql.*

    .*oracle.*

  • ransom_oneliner

    All your files are encrypted, additional information can be found inside of {EXT}-readme.txt which is located inside of every encrypted folder

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you have any questions, or experiencing troubles with the test decryption, you can use our chat on the website, our stuff support will help you as quick as possible. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1402

  • svc

    .*klnagent.*

    .*tomcat.*

    .*Sql.*

    .*cbVSCService.*

    svc$

    nginx

    .*Firebird.*

    Apache

    .*Tomcat.*

    sophos

    .*Postgres.*

    .*Alert.*

    .*sql.*

    .*Mongo.*

    sql

    veeam

    mepocs

    memtas

    .*Sage.*

    backup

    .*oracle.*

    .*SQL.*

    .*Backup.*

    .*kavfs.*

    .*DogGuard.*

    .*cbService.*

    .*firebird.*

    .*alert.*

    .*SafeDog.*

    .*postgres.*

    .*Notifier.*

    .*backup.*

    vss

Extracted

Path

C:\Recovery\9xfuulq-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 9xfuulq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you have any questions, or experiencing troubles with the test decryption, you can use our chat on the website, our stuff support will help you as quick as possible. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0A11F0CC03D1866 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/F0A11F0CC03D1866 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: eUXKmgaSo16xFEgjZwQCmPz/F25xLfJgpQUqGi8vk8tRRU1abX+4YwD88NQBnZqN xt1i9oZ2sRRoLlR3qaDydhoSmdsvSDhxqC0Ges5lkrMRBzOihlMzliKGQSWVD0uU YmPQH7Tk/+AnQOsOL3r1w2IxJvxQjC38sOUxO6E2JOHU7q/NsEv0tYkxvKzEfdri PT9HmlIrYTGLRY26ucQ14exq44L+BXbHybdusRMMp+Vhf9hRfRSklrt1rNaVJrqd v9/ozpJSMnOB7z1Uh5svKNEUr7iIKwh/P4eGc/Hg+Z8G0jQmY/fwtDTW0LvC+TaP QLhH0UEYNwoVj087cqDAQv1ivBg7Ao6aVtC8pFDpsXir9KttiE0TL6sXVqjT39Y6 PI4zUfSC6dQOLPouNQs9rLImiWBU2x7EYwo1bNFTq3PVjIIiPKw/I5lqwOXsqRWh BICSdxJ/6QClZ3RwI5lmdSF0GjJ4eisl6gP0kqWKMzXp/NvOigTOQ6DqefZQba3R LW6M6928gT6rTds7VnO2vqFjOJ2ZbnvX7rrl1orVWwZoQJZD1vhVgkUFebZQsC+6 77JSQdEmH73wKY0oieqkn/m4Odggb821gtxTSWq+mTN13jxC3tGnUMFk/QttQeby YnOs2tUs1JiRegZBZ2zwFscuH23o9dGxCaTz4rsIT5IfL2tlIrvf/rKg1FOkVY5k H8UvRV4X3F3RwFMWGwNL8KJTBxb0gFsljHBjSnk7dg0JIc6Y6/BctTrFEzTM76ZB p/CDNinJjA21egU+wHi/QR3UiU+AglPqxRhBxTfZzfEyWVpbrkiVX5s9pgBsrEwy 2cFnOK1pHFcVe6JXkQ3aGHqenKNQXJ1xirxwubSVwK/1G0ylmc14IISOJZFVWS2X vi0EtCYZPmJd/lMExUnQtUrj44bu7YHoSXyT9YfKUf+a2bYVzEWoe6oe9n3R6M2P 2oJ2gIhZ2tQsd5tVwShUQnVlvysVMSEpZUJfMdZac6A/hkH48vvjVIkSlNZamxnQ V/rY85DFZ1kMceSIMIVst7y5PerIoBV4mFtreW0Jj/PVuhOdoBpGYxz1Tn3oIYKY pLRWSRaqqv1sCBTa1ypia5SsTC72tmZ2Mp2bn2cDciv5uJxcpoIHFEB3xo6sprPD 88Vta018WNYXVF5t4O2djLc9K4WnbBgMAfvvHQ/BwBVzqM0144hzLpy8JCF6CX/4 Ew7KTS7vgPYVt1uc Extension name: 9xfuulq ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F0A11F0CC03D1866

http://decryptor.top/F0A11F0CC03D1866

Extracted

Path

C:\Recovery\512x5vfh1-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 512x5vfh1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. If you have any questions, or experiencing troubles with the test decryption, you can use our chat on the website, our stuff support will help you as quick as possible. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1B4700D81BA67DB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/A1B4700D81BA67DB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: tc6qHKja6tG9O9iTXSEx0xYjjYylTIsj+ik6bH+yHuNj+bNIb/7SqsRcujHp6uCl MMLXh3RdWIVXmUTR9YSPQdpRCuBxn6HfMtTXLKwRrrTtZoNYSwSyvXQ6EgP+eaMo QPSnasfYZfJknIWE9xfZFkaRKYVATJI2+P6L+qmBSuHKEkB9RYTd2Liv+emB5MYs Kq0bairvj4BfWYMFspdGj38cBS63O7KrpMC19eMPegjDncOkpC++fB+60IS5MH3i cxc9UHGxgHAH0lPbrk040FRMk9uhjVMMb8r8MiQkp5ov83I23nZG/ZAWcfz7eOeB VZlmuLwuZ+LdZrxRv6cyUKQCcpFWo+FFNqTXSIZFofGDuzy+xaL5cAkZEhZAegZt BqA09g2vjpMeOGjS0wWOnGgToCp3P9Y66PeTeRTSUpKW0jyTlaBOWBFhd3+ZANGv ubutyFmg6wzWu3TWFxTB9sntG3mkBGKrsonIrxnAT20KIcQJhiWnufw+17sK29g8 Iwujcl1zmlcygz7Uq5sCrAha9C/M2waHMkZE8/CEMrPuzv5bF7NXlJpg8xfT0AW4 vc9HEWcPJiudlDJXkJvUXVPJwUR3gn39B7kjpR1zueqCT1G8+AwJBMRewqNuIPVx dzDiy/2vt9C72zURBuYbEoQMMc1w9s0wTy76AuYveOz4du0mjDJ+yIAQMSafXgq7 2WDmRaK5Pg7CQIb9eRVKfuWHtqaeVj7i/JN/0CgeegFvrP6k6K1I5+s51hTiP0kC 9+n/9SaX32UdT21a/5194RMii/7Y/djdKZ2aMhf9Mc5xUMBE1+KPMi8I66p9QElq dnhmQNT2wx3NA3naHyZpAhviU2aq4ZI9HGFoNb9Aa3IsTpFzS1Q7y2ZsCESeogBB qvdyOWYu9jnbNyjZqZ/IcIbBMvwo0yCK+ght3/3jEExWKdfgTgnn8dYn37uQwIMd Av7u/SlqQuR8JUvVIjoUvWm8QXtkDF6SrmOPv9iqJliLWEeFW12MJZWYRW4YMw9f 8UBJeiB1LK/AhM2Y3fej5niS7uYrL7MCr16rpkVq38x2Lh5A4/jEcU1o/BF4VxwW W3DbTXu1cV5Em4CnxALnutBp2rBjxNtdrHZfQxUDBSMDgPgd8nOapIMZ1IOByO/j gqoJmD1ld6emgVyUJUx95Zadc9uLH/aVuaROb9Z8+hE7wnktzxP16Rj42z6AKdu+ a00wU5ApeO0amhvJqE1VYSNGdupqCA== Extension name: 512x5vfh1 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A1B4700D81BA67DB

http://decryptor.top/A1B4700D81BA67DB

Targets

    • Target

      13d4c1451da6fa284c08c669a7d0e7c1_JaffaCakes118

    • Size

      164KB

    • MD5

      13d4c1451da6fa284c08c669a7d0e7c1

    • SHA1

      2ea65287c7489d8ab5abd04e172c55d1518a4052

    • SHA256

      df724c49a1401d66f690b0a940f70bd286671448a625690ccdfdc4c42b4b5b07

    • SHA512

      f845335dd84b5bf9b20889dfd051bf012dfcf96adaf4f6de171b3a8e62f42cf03c0e18314ad6ca59ff3eb5e1c0ef3dce179845aac6582b9438c0b13809f47554

    • SSDEEP

      3072:ffYWjswg4fQlt4ndm8jX5IXzs+M9VQHDO9KR/vOst3b:ffYWAw9fcUdmwIXo+M9VQHDxmst

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks