General

  • Target

    3cd7e62bc197926278810ea5f6adff19_JaffaCakes118

  • Size

    166KB

  • Sample

    240513-2gwkmsgc81

  • MD5

    3cd7e62bc197926278810ea5f6adff19

  • SHA1

    ad18b4f27039aa3b3ca59b7b6d8ea5cb309d78a7

  • SHA256

    2a28f11ca820bd0bde24d41cb5307c8f2fa70174536ac13a99923ba70015b36f

  • SHA512

    214852706e4bb89464a92625e3594b19afe4c99157d1706493e4114ac5510a64d3af7ff88f09273c67ad3d20f1ead61e8740acc4147432c64755e9eccbac7c71

  • SSDEEP

    3072:JLFrb30BRtBZZg+i2ayyYOCWGPyLydrkxMT3Q44CTrZmDa:NJ0BXScFyfC3Hd4ygmoD

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$MJ1r/FRZ8IrIWWZ1qhl4kuqs9Y89Joj2LO9aNFDkqDxkAPPgObiHC

Campaign

3238

Decoy

cactusthebrand.com

triggi.de

ohidesign.com

travelffeine.com

creamery201.com

transportesycementoshidalgo.es

labobit.it

yousay.site

daklesa.de

besttechie.com

directwindowco.com

conasmanagement.de

devlaur.com

moveonnews.com

mastertechengineering.com

solerluethi-allart.ch

brevitempore.net

global-kids.info

ceres.org.au

pelorus.group

Attributes
  • net

    true

  • pid

    $2a$10$MJ1r/FRZ8IrIWWZ1qhl4kuqs9Y89Joj2LO9aNFDkqDxkAPPgObiHC

  • prc

    tbirdconfig

    excel

    steam

    infopath

    xfssvccon

    dbeng50

    outlook

    synctime

    ocssd

    onenote

    isqlplussvc

    wordpad

    thebat

    mydesktopservice

    winword

    ocomm

    visio

    sql

    thunderbird

    agntsvc

    encsvc

    powerpnt

    msaccess

    mydesktopqos

    sqbcoreservice

    firefox

    mspub

    oracle

    ocautoupds

    dbsnmp

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3238

  • svc

    mepocs

    vss

    svc$

    backup

    veeam

    sophos

    sql

    memtas

Extracted

Path

C:\Users\2zv742-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 2zv742. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7F8F90C705CD611 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/A7F8F90C705CD611 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: n8MUN99w56Ru7Lj9bC43BhnNh2TcF3J4rdicxbdhXGbX5neQsONTTyKiyxrAyoa/ mZjETQ3SdQOvyULpyhsyBmLoL+EOmTSPayG5nVZ/8Y1sJ6Uo0TWE9uQqfNSBe79L 67pX4ZyUOywP0rMficK5aoZhRVt03TMefeBB/EAv5jS3Ixi7E+j0+eQMs++gKL+R m3ICPb6KPKgte3W94ShwpjxGR7VW9J3UfxMLoX24FZE95mkFRTWav0icwQMeUax6 6pV4jeTfYNk8ReIZEt/uEpFWFUwWaYQEJHKR430nlvp4SRHAul4m8kCEZiAJ8Fms 3Z2ROiJJcvmoUUiVLUwap8krFnUAk+54WM2cGHMFJdDPAXG6BUvhbnT+mnsK4DwY Ch2wOoNaXKWoS/TPGBV1sxWTwZuoKZJL7In/KIxPGdRirx2mKXp165GjR2iHiusi ManysUP8t5ikR+pF3m6gXlxU/QMcbL5LTfhIG7u6ASfd8bHTv4Om3ThoZY+liViQ 5lpsoBRZz366/dhQVCtk3fee8bMM2nK9g2ZENVR2opvkKuov1/eG8jzO7aO4YAbH /jpkfjBkPIa9WsSMfmslo6/tcaa7D80McKP2mmOUBMkRBJ+oV6VL/N6s10XdEwGI kZOKmZuvqfotM6fBaI6hPoYBky4M9iDAV5F7ebyRf3ecJfAIbQG3UDnnfthwSobd cy5P2N9bhDaxPyy+UxWvg6BXe0ZfZ/eiKNb+RuWBB6pNhNjmqnJvhLDML0n+sIeI idfYST7WEXowZifE7sCwBCKWmX6lGVdXStB5U9lQE+8+2NGSOp3ha3hTRcqBVEzh xia/ThYhZxmvwRseRX3NPY+IQ3m8lSp7NfT8n0qdRe6kOa5mo4GqmbirIsq7iCLm V6LZnj8e8oY4Jox66keNRsG0YKjBeTcNE7ap7MH5TRdCnXcISkDkEgqMn3E//CBD y4OcFIjV+0KNEcUOfh13pBc8mhW+eHAa9GrV+g313VyIyLQWnJGPmno07TZAltjA RytxvaZt7xoTfKFR/npD6ZA+HXQ6kQHaQm5y0WUKtSzdlo0SJDBVI7vCmmSt0Rtp kzuSqOc8luggXvIkvbWBoZ+4u1nsdPrZhgZ0YzSe38sBVnMHAa7MMa7f2cDqAV2S HKG2BQFFt3jp1XVKMOADjY8KO8TMKku7fLM5f7X6w64Kj+J7F0mKxiRgKQ2uiYya 5NVfauq5kpE6sVEs/LpjLzdqXrgnG+EEmhcTd5r2acjtREMtDYYBi+jrFDJGwzS9 i8CeBsBx15XEvMAnxRdyX3PFTUe9e9oJ0dqOmMJuUPlocKFdQFHh55FP5zRxGvHG j4Ykf9aC3dSwXlMu7DK01I1HDCTJEA4eF0iBtlkSmGGuddJZbRY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7F8F90C705CD611

http://decryptor.cc/A7F8F90C705CD611

Targets

    • Target

      3cd7e62bc197926278810ea5f6adff19_JaffaCakes118

    • Size

      166KB

    • MD5

      3cd7e62bc197926278810ea5f6adff19

    • SHA1

      ad18b4f27039aa3b3ca59b7b6d8ea5cb309d78a7

    • SHA256

      2a28f11ca820bd0bde24d41cb5307c8f2fa70174536ac13a99923ba70015b36f

    • SHA512

      214852706e4bb89464a92625e3594b19afe4c99157d1706493e4114ac5510a64d3af7ff88f09273c67ad3d20f1ead61e8740acc4147432c64755e9eccbac7c71

    • SSDEEP

      3072:JLFrb30BRtBZZg+i2ayyYOCWGPyLydrkxMT3Q44CTrZmDa:NJ0BXScFyfC3Hd4ygmoD

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks