General

  • Target

    44e5f6b16ab566006f4d970662afc38e_JaffaCakes118

  • Size

    158KB

  • Sample

    240515-g9g8hadd62

  • MD5

    44e5f6b16ab566006f4d970662afc38e

  • SHA1

    67f15baf34ecf32839c441adb55c309bbda173ac

  • SHA256

    12096093901347150ac72d6c9c1cbacf4de7d6a51ef1ab4cddc06f85311dd8ab

  • SHA512

    f5596ecf863ee98b550b86da3d5e560994dd23827170fec6aaa4dd515ee147d140a24671b35b814303bce4164729ea9d929a4345798997132a7e91aff4c1cf8f

  • SSDEEP

    1536:/gAJlgaPladwnfzDcep9O3F7Pbi4eTMluxtXDCntTnICS4AEuzF8gM5iZQ1+mexx:3PwdkzDcC2Lbi4eTMlwDCnuzO/gQw1n

Malware Config

Extracted

Family

sodinokibi

Botnet

29

Campaign

106

Decoy

turing.academy

alcye.com

profibersan.com

martha-frets-ceramics.nl

casinodepositors.com

omnicademy.com

coachpreneuracademy.com

bubbalucious.com

ownidentity.com

andermattswisswatches.ch

xrresources.com

buffdaddyblog.com

breakluckrecords.com

rolleepollee.com

christianscholz.de

richardkershawwines.co.za

yourcosmicbeing.com

dogsunlimitedguide.com

distrifresh.com

pourlabretagne.bzh

Attributes
  • net

    true

  • pid

    29

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions Good Luck

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    106

Extracted

Path

C:\Users\v160g73-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion v160g73. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0A053683E59C34E1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/0A053683E59C34E1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: RRy0L4zYLVhURSpiR9lYE18KAA2KAoIECAieNZdgBTTMowt4smdtdLQpt50iL6QN 4ZdLOtL+3TJecEY65fxixH0hhPS19XZcSxtJ55Lk3RjU0QLZ+ArY+rnmiwSduwVf f+AHk06E2p4YZUwIeGLr1oVg+0OLTSZj26hdWX14eH8VcQRjJ5wxbpuJ5hkOTQsZ ZIRgL0OtxLAJUIy6cEREw3UrnRrhpmUPEr0eLwSQIRRXycC9OLv6+qt+sQunzO5K nAKlZWRmksBrnZj613+7EfeJNWP8YBKXAhFxChrG5DxgOkBK3YIF7WQenCU2uZDB h1Lp8j3t4ndioH6do4nL+1Yuw5bUarB1Y80Fiyk2mbs+k02qHVagBXSHVNIxrV2H YaRhhorZjasPVtUG2eLuLfoGzjnrP+sqq8iglc44pK0Dz6xf6zCtoiYrFSaJ7A5x 2Pwo4FILNIXa3NZdqQ6h0eOem5h/F6SxiQf8PQZ5buVRvMpIykbdIUb9oEekZX6y zEBNVKhIJjZfp4ZIQ50vso4PHiGcaDquSXUTqCizDKJIfPJl1+jXG363ZnEsf1/6 wAWn96M2Jecn2eAWTRO5GBbGuBGVZhJU2Zi5tAJM1JLi8e6OvfKNidrIoo5Hs16s nKm5ttmucRHyTo+D2HAUjtlzMPUmdeItTPkiX2848Z64KrZXOCHyDIBA2EAEnYCw CEpZgigQcy3rf8WCYZH1/xpphffg3mJ0i+pxfNfLocrd3yuMSeNsfsWOxg54rMvN UuyWhOBkNcU0x31MKRJv/fBIBGKrFyyArv+4FGIC+EvzznpRXDFtDrctAS0hVhvB O0KYgt6ICpF34RKju+54igzbHv91L94NbHy/qzGWbxaERfKx/Ax1qIyapsaJwcEZ CpqhAESbVGm052afUN5TzAZNwZfXdbQ1NBkhlN6/K4CfWE+TN7gjyudDy1FSeSP1 mZoMsxGVQKRNjlQ6RXjlzbvd68MDZa4GfBC3SxsIbJu6x2QfbAQxh9+djEPMFIvE 2L/ZNp9JDytmPtxIaMiAB8/A1o3wqU3iGYBmCyzQxBAP3FCg+ej8wP4hitffbVNJ p5NvIiamST4mH5p1jae3pu2pxnMrfdS4ZHKX9Kor6pNm3qwonh30M/UkUL1fcTiB 8bCZmdeZK1a53STYQcLHyKu+Qz0nEb33IClAxg== Extension name: v160g73 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0A053683E59C34E1

http://decryptor.top/0A053683E59C34E1

Extracted

Path

C:\Users\aitp3l-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion aitp3l. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7384B9686CE87DC7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/7384B9686CE87DC7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Ug8O5Q5gxtsTm65doPAj3zkqSEQIYqQYEOOdRZMYs5oqhYgeOcgE4qiJ6dFiof9j 3oXKlMGfgJi+htk55KEg7mIELyNDRC22CnO1l9GVwqnxz2dkHzJbcXJa/24KYDHp qHPWJFcACSrlh2Q5DknSg9hKaCVxl/9jjoUwP3L5PA8Kyj4SbUdOwxaNgeWdX9sS IW4wR62KcGyZtH3PE8X4tE5P9zezEOYg94NKNN/ckqw5BQrax4Vd/823Pee17NFC W4+LzefxM74TnBv6eodyQ/Xs+tUp5Nr46nH/YqeHBPihIHnyAL4RGEerJlDL9MyA u/L9jfW7HoQPEmlZpOfIaGkZDPN9jvQ9ZPIrHOQt4XEPyxNi5v9Oe1nMdcQjM27B 8Tvczvqk5VjyJ2yBQHCiZ9o3FrCuzx7M3SieZdsvgvjIIW6hRqynSBqrdkU3Ye+i qK/vfTDdup8b+9OvMQaOWF43+AXvaczbm61X86x/YCvwFKlUEj8bPU37L1dY1jvm OoNxMA0u2ZeB4gfpEmMJzaNNXfEy71nRPTfK3iuFkPOIRMU4T1TJUflw3h4Szz4X 7Em+1yi2nbLEW2yAdO6bhIYzPcZa1sOvNrSsr7M9w/pb4cOP27v6DHmpzgzJv7SE nF78feCSkFW8OW3YJqErQD7xSoBCUZpq5PUmZ8PUiM3/gyavNRLpCUceEOVCjayW 01vzKG7DM0HLd1+PvD4eLNiS1sDbq595kcZZwR864Q06CiQnU/0Nau02JrzvUr/E RB+Wm4M/XMn0SsLNkO4nF8NVe174+4sDFuSKL3Qa/XLAKa+Kg4vATXT6mIj1LqwO MK8FJyOzUnY9SaqigoXgQY7FXHi4mzLOea46hz26Jr6FHQWFfKEF6DlQd68ukPmJ /uwg0YhcvdOyG4f7Y/YRpbaTg4+mqzXaffjkn9qNWpzAQR0MGiBG0Oe70BTEENJw vHnng5/s/59RA+bOL/NfPUy8t1kmq0RZGIGBtXAADj4qqaY4n7pA9QGadQa70+US PTW1pzfTJMyiyxJyoflhStc4OFyD7X7b6rywrSRW6TNXvTfBQjIOBFHb8xndGM6w WHMxZLEPlJPZF55VjpyGbFcy5TqVETiOGG8NHMM86BLpxSsBE4sGOhW9+QESqOyn 2LrZYLzYt8FWF3lBmGil7DX8wOxJzo0ziwPQuj4enqqjDA== Extension name: aitp3l ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/7384B9686CE87DC7

http://decryptor.top/7384B9686CE87DC7

Targets

    • Target

      44e5f6b16ab566006f4d970662afc38e_JaffaCakes118

    • Size

      158KB

    • MD5

      44e5f6b16ab566006f4d970662afc38e

    • SHA1

      67f15baf34ecf32839c441adb55c309bbda173ac

    • SHA256

      12096093901347150ac72d6c9c1cbacf4de7d6a51ef1ab4cddc06f85311dd8ab

    • SHA512

      f5596ecf863ee98b550b86da3d5e560994dd23827170fec6aaa4dd515ee147d140a24671b35b814303bce4164729ea9d929a4345798997132a7e91aff4c1cf8f

    • SSDEEP

      1536:/gAJlgaPladwnfzDcep9O3F7Pbi4eTMluxtXDCntTnICS4AEuzF8gM5iZQ1+mexx:3PwdkzDcC2Lbi4eTMlwDCnuzO/gQw1n

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (1113) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Execution

Windows Management Instrumentation

1
T1047

Defense Evasion

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Impact

Inhibit System Recovery

2
T1490

Tasks