General

  • Target

    aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729

  • Size

    1005KB

  • Sample

    240529-payefadg3y

  • MD5

    650dd09b5077b157727868148ddb3307

  • SHA1

    67c6b2344e9f13eeef5969979a58e999f2f09542

  • SHA256

    aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729

  • SHA512

    dfcfcd5fc543291a1ea56f6ef82fb98d7c0269bc9be4bfb338aefe08afe700e0b055ac3a82d1426defa53cb1cd63cb46ef9972da776b2c10104293926365b5c8

  • SSDEEP

    24576:R54YNXJJPMNYGBVsWpZW7Qy8G0DpmAU8wKwTDS:R3JPMNrH40D9hwKWS

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK

Campaign

7595

Decoy

hiddencitysecrets.com.au

groupe-frayssinet.fr

rimborsobancario.net

vietlawconsultancy.com

live-your-life.jp

verbisonline.com

sachnendoc.com

htchorst.nl

bridgeloanslenders.com

petnest.ir

myhealth.net.au

gopackapp.com

jenniferandersonwriter.com

logopaedie-blomberg.de

osterberg.fi

bierensgebakkramen.nl

refluxreducer.com

thenewrejuveme.com

alvinschwartz.wordpress.com

leoben.at

Attributes
  • net

    true

  • pid

    $2a$12$SKsv8RkaiMRiIv.rk505vOoBpUyZQgGeKVc11LA6kWdQcxENhkyjK

  • prc

    firefox

    mydesktopservice

    xfssvccon

    infopath

    visio

    encsvc

    onenote

    ocssd

    ocautoupds

    excel

    agntsvc

    outlook

    mspub

    iconcerto

    wordpad

    sqbcoreservice

    winword

    oracle

    thunderbird

    ocomm

    mydesktopqos

    steam

    dbsnmp

    sql

    synctime

    tbirdconfig

    dbeng50

    isqlplussvc

    msaccess

    thebat

    powerpnt

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7595

  • svc

    memtas

    veeam

    sophos

    sql

    vss

    svc$

    mepocs

    backup

Extracted

Path

C:\Recovery\wl8ptg587-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wl8ptg587. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B078344D473F8790 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B078344D473F8790 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: JuOxdzYS6faZHlP8MhBiNUSdH8M9HUZ2DshVi8IrygQrrj/RLv4jVVK1GznEU6WQ zYW10o40fCbn4ZWDao5XJhs+8mKJGSip3sB61ApoUV6KDvd2f1pBQtIsWPrUDe44 iRrG7QgweBYvljls3esyH1tNEZV+LEDLS0xxszk4B8hq62rLlMcWj87DPIENJ0Mu jwBn65uVO155BAqps9UYrAgdjYNORad7m2URnH8rCPAELLlbr+IEV05pnE6jNR/w 0N+GQij1KA/j1Fg5mf3U0S7cbSCzfPTThryBEW+dvxsdEEymbW0en5NqhnyIEsrc hz/kYIYXis89YWx/hTD5CQn/AH0hxRsykKs3UR8c250WvOGxu/CGJSdTjEWyYTHL 3cF9xYAICnin8wlS1jBERmP5EsCTRATlpKz0GFRTJzQBg6C3fWaz2N6fmE2aGo6E pkDSmmyx6w56KcDoXmj5CSStdw1uRmtEs0scgCXD8FeUPsEN9TIAiybVGVbVpuw9 UnucrhGAEFobeN4MHkDp0ELaIJtYnC31kvZlqH8IINYvh5amIMJZUPMZs73SdvEk xJREWiVq7iHzKRuY1bQODi9esnhkI4OYFG4jq2K7pg1t0GfNkVCGjn2ZZUZaOq4K a/X1dGttz+NKrw+x63QGSnJLpOupZyuzJei2BE/UFh5PmNfVmb4DFg/y0FrHoxQL I6SHjxhaNVdguczbx53QAIu/cy/KVccrD5fgPhghcFcPHHx/OrEHE+VWZV8VmCjr NnZ65/kv5lxK05964BhThVS/OwseKgprbME5hPP3XaeaetLLnwNwaZ7f5KY27PzF OgQ3PD4LDfFeeTowyQF1dw9lubf1z/dHs1U95bf91HSGs/GSPKXk+WkZzaTNCqx9 PJiLlkmf00YS/lLW0lGp9FaQRzHhQmiz7NEHeF5pLzA7e3ZM1vxgYw74tEcz7PaO UsLXkzpGbWIE0bkwzoY0u1LvaRgKz2moodVxZX/9ckHwC0kTw2SNnsmQxuS950Ev aItLrO/rXlKJDa4f32qxV2LoPoscdDyyPnmiTaJEYifrKHagC3YuZo3DRv+uhE9s fk0hlRzbvLaaCab7aSKFYEnayLWoDWm842VvG1dUIQDwFeUP3EFvpnk9Koc1iJpl 9mFpa2GWjYqhtKWSg0jAdyt5rBMdg7mBjn3kxE3UUTWRUKzdVVZv2ftmv3bt4j2K 8isX3rEYctVJhyEOV5M3VVeHTFYdRJklkf6TH8EzxerRI5E8NWXbCdVscSesHN99 BaMHD7Y5RCFHc8tsxclLPpDOj5XbrYC+i6qS1qQqy34xHZYAV8lrc5xFS/H1EDhQ fCVU0l/ibUxokCngq+XSqEa5FobhTIWF3c82ow== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B078344D473F8790

http://decoder.re/B078344D473F8790

Extracted

Path

C:\Recovery\647nkcs9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 647nkcs9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/865861541418CF3A 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/865861541418CF3A Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: SJSAfwbmX+qZ2anIHz/Nrlq9KxLbgf5AOpY+Up380HwtAOADSCt7rbWpYHRWDR8I UVOvMP9du5eoZfKTJ8QnDHr7DzdTM6iXLZ6jrJcvovQoLWzcrOvawogSUV6et8OI wDD/kvAUCoZWtKtSR5O5jIYRtMyAPzHIgpw/NxDIa95JF0BL1WjEC15BYDiAwM7e kMaQ7gfYbONpA/TYOdJzC+qnNQM8+fOkGEeq3sr2pDQVBXNAUK1Oz0GqlRgZ4ns4 xx4FG/bBgfZfyvkdXEOrOv4e9hnKipeYv8jjjcHyd7Zy48pKmZy3Nj6SIa3kJYDi mVj+eLrw7LO5qe84xolK79CB5vkoGq/SCRELhzqoUIMCtlkJ4nMJ2mNk7ws1qahk 2MgEJpjGj8m0MtLGDRiBqidXwnQ2Ht3imxT3CRc+eM9sb/34M7eDYVazVIqbMy6N wtWarcVsRrdjeLAuDSdRDqVgmT+g1ThQ4daDUl+ufYiIiRHyaQaH0ooJdOVavi8g WGpvzkIkXAZKMCuqMg0Ky85IkkuRFTqQ8DqIXR4lwOJNeyHp/IzFVxiXlg1j1mVB yz6JtWqfU8L5aKQsHQrpXE4fpytj3Bn0IilSxD5KfWHOgfpVZOIn5D5MnuBW9F3y 0mQtXk8HjsZDGsd+uu0TDWIM9reCfmtaENQAILuJHrN5d3iHNhlnEtaCbcjr4lpo SrVeqsZ3+/eoypOkGt9/4wUySx8YxL/65psdR9Rw8uCjlC1vtScCP/HWWnyV/zkw 9myJHuxMznCOX9OYLimdmmSJ78U2uAXLg0qG4EBFwL5ryh9M5WX9fZ+b9XIcSv7E axR8ouxdGosvtUkqtzYb92bZxtMjLSRl9/RQRTfdq+8Ch8Y1AEVjsvrnUtaSissT y18OUCkvfAF3Pf+W58mS24oNss/A0HIIzvNnKy5QXpU1d3I2LDakRauUAnJJpYXT 6bvsztQlX0M99iV+BEGtAfYa5/gRm3NEBVtvGxg+YxD8re85HXfAr2VeGkZQ7Qrg 9YdKVHq9SNWlogKUnxszqWWeNczdIMYC9AFbUbPFnoCBxbwHJH04ZWl7kK463cD6 6qfjV4qFxW0lYNmyqUiD53ky9nugYCgfifKaUe6O7wlrLVav5Hi1nAOtKNWu/EKI RUybY9yvrhPduJ4FlBRFl6jqB5cy9JJ8GR64j66kgNJMUACaj1eFGiOGx3MrX6ES tM+Sb99HV8HH1oC2iuH+rckZRd/W+jPirctgQG0tfqtK0t7hWObxsHyTv5zbyS7/ uboMezd4wIqj/8QHW+rgGyM14ZWbLnA2WdcqZnRIH/GpZOL7G9NuAjM6boWjgei3 trW0b38D8pnOc2QPllTB82bZyoxVTny3g1aJ09OzC0k= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/865861541418CF3A

http://decoder.re/865861541418CF3A

Targets

    • Target

      aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729

    • Size

      1005KB

    • MD5

      650dd09b5077b157727868148ddb3307

    • SHA1

      67c6b2344e9f13eeef5969979a58e999f2f09542

    • SHA256

      aa0b989579334c305be234de57baa8ffcd7f9e11077820199e58b71bd851c729

    • SHA512

      dfcfcd5fc543291a1ea56f6ef82fb98d7c0269bc9be4bfb338aefe08afe700e0b055ac3a82d1426defa53cb1cd63cb46ef9972da776b2c10104293926365b5c8

    • SSDEEP

      24576:R54YNXJJPMNYGBVsWpZW7Qy8G0DpmAU8wKwTDS:R3JPMNrH40D9hwKWS

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks