General

  • Target

    ac3317e314bcdfba26c875d00e3bee70_JaffaCakes118

  • Size

    164KB

  • Sample

    240615-amyhmswcpk

  • MD5

    ac3317e314bcdfba26c875d00e3bee70

  • SHA1

    46679779e7de6cbc72b8c58cc64065edd191f226

  • SHA256

    db583e09ea90ded0a3c534b0c71000fd2db204ddb6ade2431faa6c2e5adc4343

  • SHA512

    f3f241370c733cbaf9667d1dc00a8480c8fe67a49118fef757a9bcb4602654db53efa454f03a2108fd49a60cd1be0ff902d535fd6132edc0f061ff42d39f2f97

  • SSDEEP

    3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfUhdT9sT4JtL8B:FWe29/GuzjmfCHWtUhO4/LO

Malware Config

Extracted

Family

sodinokibi

Botnet

16

Campaign

1354

Decoy

prodentalblue.com

from02pro.com

stabilisateur.fr

pinkxgayvideoawards.com

eatyoveges.com

boomerslivinglively.com

achetrabalhos.com

avisioninthedesert.com

kickittickets.com

tages-geldvergleich.de

acumenconsultingcompany.com

professionetata.com

anleggsregisteret.no

transifer.fr

lookandseen.com

amyandzac.com

electricianul.com

tesisatonarim.com

thestudio.academy

sharonalbrightdds.com

Attributes
  • net

    true

  • pid

    16

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    1354

Extracted

Path

C:\Users\914tn4n40-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 914tn4n40. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/48F9C7B955B3B5D8 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/48F9C7B955B3B5D8 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: mkF2PWRASehjDEcxkupgOWDiHqo2U7smnbW/j+qFY4vwlQ4jB1T+vwiImKxZJjeh Zg0OTRxhJ0RmCzxC6T4H2nymA7/5JYdTszA3vFVtNITimDT3V4Wo7Qp57wjDlET0 jJvBI/e8yMWWajZuTAlPYBr99Fc75PcDQj9s3nW6onDrjMTvAOLqGYgDeHAVOLGP 3cCyQH/MMyEylPDcPdNul9DacKyGVVNRocb55bgdR8jZUKOyi3ncy5XjFAi+Ty2O 0teGRZ3DzjNaoWYD1kGLRlLNLtCQVTtV+p/6ISc0p9FKHGTwjf92hltFyL5HIgfR JDX1qKRjdkqptLErnYBVSPPfun/ZmQeHCcH/al44ThBljXpVBH4E0D/0SVQFz0Rh lA9BSA2nK2Md8GrxM5yS2rLWIMtyMMFy7z84VIjHqj6tUKqd6sLabsiV4/aVAMO+ KJUdqFDfHECzHlO0x9F2mMTTv9sJIJmAU6o7SBlHj1a6Ty5i2VEXiFZsEPQNjayG xtSvIxfuJZC0NVYNJ3+SPKHAeRRzB8uEERcAXsBz5x6gr5i4/NevFCaQBVHg/c0I vM8QrVHz4wahc0tA+MX1yJAzRDqsKHTKZN2PweUemn7aIdy5yH1zZl53HOY+1yOE H4MM1IFO3HrXRBPWtVkMqpJtlSJh0Krjde/543nLeE/UrjRLxzI/knEb9sk6o5cC 1STrJlG4klubYkYr/h0imAnZmm1eql9I31ancMAgazv9KozRi9a0bN2ebrKWbUBY QlSXmABWsgknNhX4cKbcdIn6c0pykfrbiVu5+Luu+IrwnBDAoB7bsq5V/Ghp9i1j q9TXp9MZSpVhqzzxXTnHCzUvzR5z7M18snrP/xHSLatvAgL2jaSia2fZFUU0wfit 4446TKS71EgrZ3mmSQ85+YNAJ/ABCxjjbOe86/pqjamyoBf/IMu2RF7b2+l37mk/ e1fuPTbM0XEYXZkCs/bwRGl4TT8pvY0t9E/Avt8OGy7+2jHLMu6pAOJtlUXKdJIa 8FXLRzyP/5TH5qq9o8Ek8vcCGbMm2dluPQHKR6qlScrFxxwHx47YQBgt4HFPGB7/ k6MptCbTJ/r+plBufq/j6/l+YfZoMCxmD9WWbpoXMG9CNXI0wH7QlKf/kxSu6iNa pLdSwQd8NBtLbEN3aQ6rlpcAN74RcKurTNF2XPnd74LC8pI441AYK+ynEFw3UWLa EnLMNXQyY1ZPr75VW1hBPNPp Extension name: 914tn4n40 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/48F9C7B955B3B5D8

http://decryptor.top/48F9C7B955B3B5D8

Extracted

Path

C:\Users\003o5in6-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension 003o5in6. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/37F30DC96C41006E 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/37F30DC96C41006E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: oPqlyxUTR0H6qXS8ke/h1SNAqTRDnOo/SPZKC8Rdnf8p6uX5zYnyRhRcIx8SD51g xomqonVe3oM85rWtIXi1WoO/BZBltECK7I+a014taJsYN3gvXG/RxWS2B32gwpS9 3eolgaIq+uTxuen1+L6lkPedfaRKTKqt3Jq7XtDR3W3bEfX0eEFAHVi9DT2eF+D7 Hixh+mL/keEn5X3vuBuKs78EFqixiZCiw115vhq4D2PcGWkDEwzCrOcVubrQfIL1 ojNkgvc4fuRJxTLdzjw4HVmTKrwLR7b5hM58YBZmim0dNhdPDigecKBFgwmW5hRB 2IbP1HPku8IkrRUC6RR/y2ab8kQuXJwwA4qMDnVikH6bf2M8yAJep9aR2IXJ65pu fb6zRLx0R9Bqk9O4pYOrCQrCNJd4//A7lj2vHbe8p/cFyJ+FLZbflt9LiJaI7FFp VuQFrDmqRtqk3Wh/fFLsBPDVFSRIzC9NWHVfz5Z44TBg85u1hp66qj3K87BRuTs5 PhbBUeeqCOp6iDqpWGQGH/XIJB460G3l01LOfguqFqdEO/M7amst44it6rin43e3 y4NqED3+WnAvNhrULtJug+TV7N7hURihgOFSmWmnzI2bxPRFOq59G5pK5C45SuK9 mmMrU0bmQ47YVHU3wPRnqHjVrj1/o6Oq5+bWr++oQuPxkOgEdH8X2GOWpk0YtJWu yU4WXi3EQFy/IdHIN/GfAjLnavylJydvj59ZPGHtzrQEmuUmIPkJQrV36GAo1WPl +/vQqGcfl+Cf4fl7riQ7zs5V5r8wuvXfhKPbP8KRV4eHQgDvF1M6Ckt47enKn5G2 khEjAHkOOtJpWwYw4F6pHFU5WUMPuRJgfjgLpi+qK4CaetiDsvXvaaC4N1xgyJvD 573zflyjTh1MuDOsYFmdVrxxQ9SyGH/8McDf0+3mUe3ON7k3T6w8CkRcmifaFR14 DxHDzdAbrWI6xSlrQ5VVR+3FlKzXz7Z0X19Eewx56chP9eUwNgfoGHBoS0jWvWxo dLrN725j/CG4mlsqlqBbg0HmxARr2LJ2dUTlZqtm9rpZMeHxaxczvAXOqMw8mP4A oAbtGpswSYVpJBO5BwnVZqivEGxvXtD+qeCddD1zyD7hKRDbG5/ZMMP4SPzT5Q5r cYnkheF2L5VTFtyBX0CB2hjbgqxRHk69jsEo4tgeTKJ9d0hnqOcTMvJvA8WGPj41 UAYzmRUhq1wWBzD9ywW2I6d1R83IVQ== Extension name: 003o5in6 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/37F30DC96C41006E

http://decryptor.top/37F30DC96C41006E

Targets

    • Target

      ac3317e314bcdfba26c875d00e3bee70_JaffaCakes118

    • Size

      164KB

    • MD5

      ac3317e314bcdfba26c875d00e3bee70

    • SHA1

      46679779e7de6cbc72b8c58cc64065edd191f226

    • SHA256

      db583e09ea90ded0a3c534b0c71000fd2db204ddb6ade2431faa6c2e5adc4343

    • SHA512

      f3f241370c733cbaf9667d1dc00a8480c8fe67a49118fef757a9bcb4602654db53efa454f03a2108fd49a60cd1be0ff902d535fd6132edc0f061ff42d39f2f97

    • SSDEEP

      3072:FWeI5JXJRGpUhFiWjmfb+HP+rnRfUhdT9sT4JtL8B:FWe29/GuzjmfCHWtUhO4/LO

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks