General

  • Target

    612b61376219736601d49d2001645b30_JaffaCakes118

  • Size

    164KB

  • Sample

    240520-2l7tgaaa65

  • MD5

    612b61376219736601d49d2001645b30

  • SHA1

    86840cdd42c8aec339575a1d0e3fc784d3ad445c

  • SHA256

    008d0c1a4e83a37d34c14993a6d76c18ae13c03ba54d12e1246fb1495a20e2a6

  • SHA512

    1c48f5fba28504ae7e176053cf4ea127fb763e16aed7a34ee002a541072903e0fbf55f5090069da776030e0b153474948deced137d1b71152ac20adb7e15e728

  • SSDEEP

    3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFfamVw3O1:veoUeZR2TRCWQFfamme

Malware Config

Extracted

Family

sodinokibi

Botnet

28

Campaign

1819

Decoy

enactusnhlstenden.com

ludoil.it

vedsegaard.dk

donau-guides.eu

hnkns.com

veggienessa.com

stathmoulis.gr

volta.plus

ced-elec.com

sealgrinderpt.com

shrinkingplanet.com

spirello.nl

catalyseurdetransformation.com

bruut.online

customroasts.com

precisetemp.com

ruggestar.ch

nexstagefinancial.com

mariamalmahdi.com

vitoriaecoturismo.com.br

Attributes
  • net

    true

  • pid

    28

  • prc

    msaccess

    ocautoupds

    mydesktopqos

    onenote

    firefox

    excel

    isqlplussvc

    xfssvccon

    outlook

    powerpnt

    wordpa

    mspub

    dbeng50

    sqbcoreservice

    steam

    encsvc

    infopath

    ocomm

    winword

    tbirdconfig

    visio

    oracle

    synctime

    mydesktopservice

    sql

    agntsvc

    dbsnmp

    thunderbird

    ocssd

    thebat

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1819

  • svc

    veeam

    svc$

    sql

    vss

    backup

    mepocs

    sophos

    memtas

Extracted

Path

C:\Users\28y7qg1913-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 28y7qg1913. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5356259464F878BE 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/5356259464F878BE Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: iRA0dhrUzKmRKS/ym0qmAIKgsyuW1l+99bRlZlcebvDYoEzfY6BDmlO/692tzQuT q6SaEiF7TGkgRoHzF546Dm+j1x6QjvJCQHoeN8QS3ig0yqMPV0D7jjZb/hlK469c 9MKSblLEo5XlJG+gOT6CU1Q6fJO2vo+OjPCNvR5NS7ltyb+OeYFEu/8dChiyEagX RwQNYoHQa8ivcekTDusSDLmDC+0HYRT1zJ0BQn+EKKivF2rCIIDRhrinUXLL8MY7 XHD8AwvCT9g1PcLoBDmtvUmWP4GglSEKkls/d1oTftky8FNNK2ockmpmBanTIcQV RCX/Xx2p/a++kLQWKxeGDF78E4QwRuCBGAl+xMj8fsXGAUo3UR4YmZxbrYVK2vu4 swnZ/odDNr9Oje2UADUDH+26ndkoQOar8Eh1IeoenKNo4eYheADjh2z8VVt3PDMc Hk0buobVyWwcUcRsLjC/cLtx/1KW2mxZvjUvxhW5uWdjuw0QyimxvXpFtEMx7CE5 10JtKTaGmC4aWrhQWYsF5fDRuMim4ZPCMOGyrRtQyMO1CFaIRXuxVUftLt6FmN/U f+xvAz9hBBzngMEmiCS+g7GaEBv1qf7zeaUF0OECg7Q1G3KJbDVjgmv7mTP9R3WK I+/WuJeqW0rNhhaOMK3K4Fp2DOy08hwXRwJkzeZ+Km3hOem4cK5r4Kw6cI6bIpz1 TpwYqzOoWYZc4x5fIAdPVM7TFTXXBHN8+OpUTX/fBFFjIVyPql58x61EE0U45nNc fQX11ta8RLHaHzSp57XfIC9engdtVaGYV7DCDceHy2CjbKhnVzIpcSGeVOdsz0m8 iqFAyJ0vbHgNqfUFmYIetGi5xexZbpSCyht1mn19oIWIEoOdVSGcttuSfRe2nR8x Pz/K1JpPnfJrsjhAoOGwT772OxiA3Hqvq71QmwaD8DNZzQFabZIzTt34Xp2VgCqg J03WnI5txTeg50SRBNCzgxqmqZPf9Q+lYKNoFsA/dsBAAMKkBVRJz7R6kpdY/FBo kLw6DF/Xp4AuGxA8zP5m9GHgWZZboynxICcxTw8WJHNYjGD2//zgtV7uCgYAWLya TQ7qIkBFw3VV7beqV6HNZoUcMH1+DlTpYuHZvMbCLdoiuPPzlTLpo29gTgdajuVj pHzvBqwcNjxgsPIOe6oQEbn7tJqJGzx4ThCXolI9zezS26uEqcI31fWNoV3fjikr 9IuBvAJ5BMm0vmbFA8ZeZmMeYs0= Extension name: 28y7qg1913 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/5356259464F878BE

http://decryptor.cc/5356259464F878BE

Extracted

Path

C:\Users\84ek0d86g4-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 84ek0d86g4. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F2FBA71BB1DAF38F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/F2FBA71BB1DAF38F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Zh71VIUmshD2CyqWsG8JUMawZecXtNzV3ZwdFTLd+t674ZTcGNXvxR+v1LcqcKfa NmZLiZ+3HVfM6VU3hh8czu+fKWwJGcdchRspe/EnGogH6G8zlQn5gvNsGxNUiWsd dej+nOwdlv2CD0KHSPH74ueb/EiIJNCVAQSywZ/u1KGRooSuHAYBo5hU745q8887 hdeCZxiwycjnA2UP+pFXBrFhJ7/VSGjbhqsrLjX65e8umLliRe7r0fmAdHEC/gMN 3y9DJDUkD+DFBeCr9wmvxuLiZyNCX1lUo7Nd7mVGMVOkwpdQzJp8l+q35zzLwWL/ RPDZDDwdCCjhuPuc6SIhXrAJagDxDqrMgL4pO58GUp6QCYXojCUP8QRSksnOPYxC 7w6q0a5wpY2lp1tDZcazsDbSK9FKfIws4R0XQXwcKBkR+KLOrOFFZMQUd0/Y3HHs oK5X+ft8Rf2erBTzCZtE8ykY6YELRRLM2+W//8pmdCimu5q+gmW/eZhXvXnYWeR5 akk4Baczu9XknkHqB33Bjz6C6g9gVhwRm7g0YW4bLIZvl8SanlFwkmnpFo9yCtVZ vjUpsXd3JhpeJvUd7gbB6SmPDNeSMEt4ZYVkxUNBHo2uipQ2fv43N8lM8LGkhsS+ tE8sGdVZI8n3PhTBJ4BbCq6Jxl6VyYwhpbJv+YKg8xaNMaqKNmijDpdxWq7etLEJ xeNyw6UC6l2qPNwfWS0W+9mJOOEclDtc+I4ejqs686Dk934uS5skpyiKTmuJAW54 DQDoQCvzs/1WnsWsUCZpCzS6BLKWMG0wuNak/qGnnm1+nc7xUDvKeyUcVwZqL8iD 5HuRS9sQMt8h1NocJOE5Ct2JzkZugyiO2hCOhrY+LPH7K4SnfJd0hi3ezZh34zzc VhfrVG77m715t/ZKLIiq9d6QCOeeezg4F0u/X7RKrfgHQ21bDXcNb87BahFQix/V jarEzUvcZM8lM8g3Z0slLFbOBhVyqVLlomrIZZw0wO5SgOwQ/FaSz7HaChKQ0qDr MKvKmFMHYCv+9TObS0XBOLiRxeVpxvykArdJDLdZaTfUyjnSuszFn4xVwf0eFE+f /BPyhTJKqUiDCSt2R8pvHXZQo3TlKdIzZp5HBy9ROm8dVuxTqjAgotHBuseG4mSb tdDALTLRnV1LiXpivpLVXimnutvzT9unJgK6sP+CYsPajJuTolJNENjTi/uvm8DJ xXmsdjNCTFyETtqzFirmK5bFESyU1xkNM00= Extension name: 84ek0d86g4 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/F2FBA71BB1DAF38F

http://decryptor.cc/F2FBA71BB1DAF38F

Targets

    • Target

      612b61376219736601d49d2001645b30_JaffaCakes118

    • Size

      164KB

    • MD5

      612b61376219736601d49d2001645b30

    • SHA1

      86840cdd42c8aec339575a1d0e3fc784d3ad445c

    • SHA256

      008d0c1a4e83a37d34c14993a6d76c18ae13c03ba54d12e1246fb1495a20e2a6

    • SHA512

      1c48f5fba28504ae7e176053cf4ea127fb763e16aed7a34ee002a541072903e0fbf55f5090069da776030e0b153474948deced137d1b71152ac20adb7e15e728

    • SSDEEP

      3072:v0XoUeZ/DVS8L73ea4MoCLfqQvFfamVw3O1:veoUeZR2TRCWQFfamme

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks