General

  • Target

    432762b33257f4141a6bba741df12acc_JaffaCakes118

  • Size

    166KB

  • Sample

    240514-1b76tahd21

  • MD5

    432762b33257f4141a6bba741df12acc

  • SHA1

    fad7158d984be89c9c02837ebee741605f878e83

  • SHA256

    997002d2e69d8b491d6bc9d9617add41fa8997b9add6f9b762f67972575ac616

  • SHA512

    8cf350107bb8e1a8c6e6bc58b84b8d1c3762104f019880a42cb57a32376a5e892d332acce171aa6fe0815ff53c952dd997eeaa42c151ae2d2cb0556f9e97630a

  • SSDEEP

    3072:MJMawtnGqtWoKeZ9fh1CgnNto6jfyKON3+yugCr:Ww9vteqJggn7oUfeugq

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$7vQGwammrKapjAK1OnKfi.DalGkro9qdMRVED/z3EVJyM6jwdd3z2

Campaign

3295

Decoy

raschlosser.de

podsosnami.ru

midmohandyman.com

chaotrang.com

familypark40.com

globedivers.wordpress.com

berliner-versicherungsvergleich.de

allfortheloveofyou.com

wraithco.com

tsklogistik.eu

insigniapmg.com

lionware.de

denifl-consulting.at

ulyssemarketing.com

wacochamber.com

boompinoy.com

vyhino-zhulebino-24.ru

kirkepartner.dk

geekwork.pl

nijaplay.com

Attributes
  • net

    true

  • pid

    $2a$10$7vQGwammrKapjAK1OnKfi.DalGkro9qdMRVED/z3EVJyM6jwdd3z2

  • prc

    isqlplussvc

    xfssvccon

    dbsnmp

    ocautoupds

    tbirdconfig

    ocssd

    mspub

    powerpnt

    visio

    agntsvc

    oracle

    ocomm

    sqbcoreservice

    wordpad

    msaccess

    infopath

    firefox

    outlook

    winword

    dbeng50

    thebat

    mydesktopservice

    steam

    encsvc

    synctime

    mydesktopqos

    sql

    thunderbird

    excel

    onenote

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    3295

  • svc

    mepocs

    svc$

    sql

    backup

    vss

    memtas

    sophos

    veeam

Extracted

Path

C:\Users\51t90-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 51t90. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1F91C0DA2F241912 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/1F91C0DA2F241912 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: NYAkUbxQ+fktCiDS8pcr5FCMnHFRQGmJoQRSmyZxC9Yf2LQMFGzKc0A//kFj1Ua6 eIWH57u3Ppe8qJOq13CpqSow+8goRtzkOivMWHjVYnHChsEbFsje8A87RiWHXH7y V0Urmm3WOB//T7ikFHObZtF6LvOBOeu7TmC6DKMseTGzoU0UQy79REv4BQlAcsGs ieE0D17PfEHIE+ygua+lCAgmeRZ5pm29sDTEEycmwPqSA0oqyCAYSScVoX2zN9aW 4OEo+S08C9tCEOgABS+IOLWZTUX34e2I2vELkb1/KnWJmeOz3PikP0bvbbnzeSKW 4FWHo2avvPEt5TcPWSp4frTiAg/0Utkpe//C+GKf+ymEV1cfDlJ1XZ/YTV11Kq0M dxc5hdDgwgS1tSf17PmQ/bNlGItkRjk+Zvg1kzflmy9FVOru12hiI/44DpW0EnqG ZgBzPrbZCTLjNEgU57ucbVAulCUMS4kLjhTHO9NmosyfDrk/anWIciNyKaeQYqP9 i+iGBYk0whbJeZrsc1xibvmWHgfaBl8vnAf2pmfWKi4/P7+KL+wF+O8P3DvDcwYw 6pRYT1MiW/KsrOaoSXD6uGDzc/CNb4nhggeGTABAxoR0rYLOQeRkhK4/TRlq4FPl WwqZ/WM+5SVaG00cytcRvnlWYS8slfdqQBKuqujZVxIuluZb+ZUKvQHAwBkOUoSb P6MQXwixga3TU7nG+bs8OuBBTotliGmjIMpz8iFNfD4+3fvEmmMOvo84gxKKfc3a H15ph+S9em+zDIbWQRQhUZ0wfjWA/e2F6nkKJ2quYcUhcnkVyM+9W/TX9mKcEcDu uNv9FMW+9PbC7MKJRFdm+XHjpDZq0DUSk8SvwZb4gzDMkQNHYnTfz40lYABy1KxL zn21Epxpwgrxuiu2yPWFOvRY2ZQW3ZK/yzb0xHMOOTn+ccq9Yy66SscgW03lEfpD SjaoBnPJc2RTvuJxajeKepoO2aEybU25yiC4zZsK2bJNgoVV8mJ2cTUs0KoevHmz Dvo9dl2Uym+h4TCfzOdWtEwTB/SYg1f/BIM5lVGI0dDHOn0GGfogo2zFp5DYnTlG X1o0/mwLELt78PWkdYeX1ZoxZ/MFmHHSzNtKrcakyWmNgOQf/gTB+TkDQCaGqSvy m6/u5kmIpYD6mHj2mN3N65Z6m4SLOQgMGu2MnAAkVR4Xu2hd3JGgefwx1kbGdt1q UTNXH2QRdRkS5E6blXZgO9WCMbr1v5pZ+IU+NoQC8hbUzIHyC/Ve9sMC7qkOjkr7 vDfNVETeWoTssnVvVHWrSXfOKbhG3k7d7trDcm8bAwHh7EMCB2KCHki8Mgfl5qHl l6Qwa6wy6gaUnoTGNwJJdGxrL8CU53yrjxXPEGFVERtHQngi ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/1F91C0DA2F241912

http://decryptor.cc/1F91C0DA2F241912

Targets

    • Target

      432762b33257f4141a6bba741df12acc_JaffaCakes118

    • Size

      166KB

    • MD5

      432762b33257f4141a6bba741df12acc

    • SHA1

      fad7158d984be89c9c02837ebee741605f878e83

    • SHA256

      997002d2e69d8b491d6bc9d9617add41fa8997b9add6f9b762f67972575ac616

    • SHA512

      8cf350107bb8e1a8c6e6bc58b84b8d1c3762104f019880a42cb57a32376a5e892d332acce171aa6fe0815ff53c952dd997eeaa42c151ae2d2cb0556f9e97630a

    • SSDEEP

      3072:MJMawtnGqtWoKeZ9fh1CgnNto6jfyKON3+yugCr:Ww9vteqJggn7oUfeugq

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks