Resubmissions

16-06-2024 14:39

240616-r1f9ys1dpj 10

General

  • Target

    b4070a6d33fd166e115bd0cb2268b7ca_JaffaCakes118

  • Size

    166KB

  • Sample

    240616-r1f9ys1dpj

  • MD5

    b4070a6d33fd166e115bd0cb2268b7ca

  • SHA1

    9f8510cee0c696b3c986c619b012acd19db9a7e7

  • SHA256

    4dd6435f7a4bf6b1ce2e3479230e6d1f9b8730000d3c261ceb3457407bffb701

  • SHA512

    3137b62656a2aee8b65f6dd0e4c79818044bc973f99af878875a3e0fc1a3ab97cea8cd8eaf68377c86840ae680f285893d485c3f521304be0d99751b3a7498dc

  • SSDEEP

    3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QvOYiEyYFarnufJIIn:ZJ0BXScFy2RsQJ8zgZyYFaifx

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$IZJvTHFCbeN2W1Jjwv1AvuX/alhPKyNm/gM.Q7VV0f.YlBUj9k3L2

Campaign

467

Decoy

jsfg.com

asiluxury.com

nakupunafoundation.org

theduke.de

jeanlouissibomana.com

run4study.com

zflas.com

autodujos.lt

herbayupro.com

milanonotai.it

dareckleyministries.com

karacaoglu.nl

naturstein-hotte.de

abuelos.com

penco.ie

lefumetdesdombes.com

spacecitysisters.org

thailandholic.com

theletter.company

effortlesspromo.com

Attributes
  • net

    false

  • pid

    $2a$10$IZJvTHFCbeN2W1Jjwv1AvuX/alhPKyNm/gM.Q7VV0f.YlBUj9k3L2

  • prc

    powerpnt

    thebat64

    thunderbird

    isqlplussvc

    visio

    ocomm

    outlook

    thebat

    encsvc

    mysqld_nt

    msftesql

    sqlagent

    tbirdconfig

    sqlservr

    dbsnmp

    sqbcoreservice

    sqlwriter

    mysqld_opt

    mspub

    excel

    synctime

    mydesktopqos

    infopath

    ocautoupds

    mysqld

    sqlbrowser

    ocssd

    msaccess

    wordpad

    winword

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    467

  • svc

    sql

    veeam

    sophos

    memtas

    backup

    mepocs

    svc$

    vss

Extracted

Path

C:\Users\89d581-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 89d581. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9F483F61986A4589 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/9F483F61986A4589 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: u5BksepoxlftycIzkbtPR6B05/llmPKwjzdJ8uPjKM/0nCb2JnNU8LnH7CyQBPT0 hCR6YBosP+cC/PCX95NPxlonpjRMKzZhMHeaDgc2Qn7qhd3/MLKE7YmD/Fe+Xr2k rdqWnQGqkGrSvSbfMMXE390RbWL8H3slP2545aMqOLviOD15sMAu8ARnkM44pWWI VxZZM+9TnTsFDSGJUluu/9s7ti8ABXNEPE67rsVFqAM4SjXDlMM55s1HOxwh3DkG lLOjXNEvna92vrD8TDvjMRy5/q+bP+SxBeI8eutxNiWiSV/Mz6qHhxO7508xC/z7 xsjc4c/NQP5pbw3A1SEQrQRkrxPpXnzCVWpkwpWhCPnMVyNMBb27gu6EXbEKVgVz YPpt9CrX+K7xO1mw9TqIWc/zvtjatT9X4FvWdR+cs5eS/oaLeP5BnRg3Q/QiDZKP kBntBg1V3PWoBIE84zjQ1JmwxAmtAFTxSPEuBTBYr7EXPd+ruI0fB8Plj+TMcUZn bxKYx/Mml0/oXKgBVtlZJ9DSCFRItWFzsXTcUFzncG/dOWvMxnZ1CSqaORg8JsVq pUi4hqkayoYfaQNx/nNG5Zw8I1VyjuCOWZLI7e5TBIHQd/77m1lXPCv8PhIfI4e+ pTLHmhYRCOzIeyUryg01u1fYyzFcDlbDssh5wpJRW6Pj/Whcg+6Zbozb+rCl95Y/ gK9RPKHBmTiL3euKTNT2fatZzpsE7xU/S4gcvXZd+XfO4EYosDVquifpaq76c/sT 02//P2wEDxKcNK5eoIybohzAgYSfL28Py4b/KRhFKPp7ZTqtQSgSve/JBfC5XAgH FfBVtFZHvg7qEXDS14dy8f/GtYpvYj2aDFNO7IWd09E25zlJQOt0Qb5uuBezetLQ rzwSKEDAP3ebvyrRhNLlpH0lejtNjZY3fCSvdS45xPZC2Hec+YIlNqhNo3XDuvqa HynZfcwjWCzTobfVXYV3htVbAnJIGvzXaGKFl4W54j5YdzFj2z+m0wEEJjZ33PZp 4j+bpzJ0WKrhUTPlSWI0Vty9lUb5IiPaQn3dVgNY6zz9n7TrCaS1CN1BayPn17z0 LPGF+p5967I0tmQhYVoTybq3MxGaOzypj1PFsxPAk9I5JVyXVjT61sbfFmgMue/k 1rF+qzFz9Kkdr17Z0j6iSDvOkuM0SZ/7uyQKLjE4GTOMRrGW7vjC9lGAyqsloXQ9 WFu/VWY6da7HpbG/5f9Sr2/gpLsSJAgw8PFxogCtSl9WEQSt7jTLwvyfrGwOhAXb LA8RTK32KN0gtU/OEZaUBTUNfyWakZROdNNhDHwBll1nE26QfWcehUCMUh4pzyW0 C5BUmDE+NaVwGDrEjWgUGB034TXQlKfHRYw6UWEJ Extension name: 89d581 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/9F483F61986A4589

http://decryptor.cc/9F483F61986A4589

Extracted

Path

C:\Users\9deog592-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 9deog592. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6B4B5870DF576762 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/6B4B5870DF576762 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8RfIgI/GcRRYUgNGyExltmkT1DZzXnoiU+Gt/qSf7kdCxPIPaStCbQGFeAfTVzNU tT1FhNwub+BNxs+p7OYF6LlsgZL136QBcQWKFjHfZJt+/ShkBbKxWS7oa5kiG333 Z2e+PO/OVLZAtvjT/rIJpVMf6ZRiGWklzxYW9AwFytDbMrnHT339O0jhCqSlAnz+ o2ayVDcbJ5Ei3rf+uHcXBSNH14LV/4NUjShBj0xZJvAvFAak6pHuqS2p94Hvps5Q bweGnkQpZQAZEywFplK8sFJAUkGmUQDyrelLZC9MM2Cxn9mp9RPS7olp8kjMXERO MIEetyCXnUiltwNp73JFUx9eG6wkP/dzkYUY9asmgThdcXXcFacQq3KwlV7AMPBO 5ysLO9QIgx//bCgKt0qNIcZeCBPm5L6B5vKVbC8Q9iQjuXm++PzEisU7syWq54Co RY144wtqh009FNGICve9cWPx/utyqQk5F7GOEc9H1QrPn0njfoGQpJrqY11GUCuK 4wjwF/r8pEtDhEF0/oHUGzeo+P05aTThKjRQiFqlS3SeAahVbOLCqdQkEVTd2Gse pOlTB4m0IIpKVIo8aRx4a00wldoBY/ad/SFWOnPHyYbRzUClAHZ6/97UawRUhtPL jVvf2NhTFs0Tt00pTMSBSplFl00eFEPAa1Xz79iIa8UhXSpii/1SSnGS3NcJV04o gq2h1EXqgaW3+67WtDOYAug5k9BNfyCTL7dNDOGfAKVmEp2ifel8DIIOVWPUzMH7 T/wpbkjqdMqdKtD7WCbYAsdtAwLBpd8sW6wh2NO89uYdmt7fSBFuXg3/UaMpgiPe RDpHwfLso8yY0N53Ki0FT9DQL1RC4keUQ9ze99CizArXBtL2eQjWGG6IahCi9vSo 2U6zbN2Dc3biGkYaoBXK5AcYH3bf/jnkCAlCpS2ieynzY+wJ7NCCgtu6yMhZvXQg faoTbQ9gIxjgbjza3/XOf0UWOSJppYf4Krjlw2N6T2OS9D95/peT7O4MY94HywQH FKYPA00I6WPRuJ6uYNVlVDBsfB8cZxEjGV1iliw+ao9KxY8Xj5Rv9JQmeDi9NJIz y4SwHFny86mrkfUJfsYgt6/Hv8fEY9K8vchaS8lmbs45LzaGnL5WTx0ylTg9xM1/ n2dLPgZjwygqYNP3i8ralkMj2tPTEtiDHibLKXbmOluVUGdNHlxvAu00XoWypBKq vvTy/G8290bLe3flu2YZrl6M0o4Dt8Kyg4oQEELX/DRciHy0SdIyiJQ62pJCX2tZ KCV+r5DGEKuPSt3QRA2KEn9nOI1r8R34tjsrmRO+CQa+nDE8ZfeMR32FLJm7W4lv YmV8vNacuUjQwaiR3H8a+to76UV2K4vNRUCnzX26jIMUZJwQfJP+8A== Extension name: 9deog592 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6B4B5870DF576762

http://decryptor.cc/6B4B5870DF576762

Targets

    • Target

      b4070a6d33fd166e115bd0cb2268b7ca_JaffaCakes118

    • Size

      166KB

    • MD5

      b4070a6d33fd166e115bd0cb2268b7ca

    • SHA1

      9f8510cee0c696b3c986c619b012acd19db9a7e7

    • SHA256

      4dd6435f7a4bf6b1ce2e3479230e6d1f9b8730000d3c261ceb3457407bffb701

    • SHA512

      3137b62656a2aee8b65f6dd0e4c79818044bc973f99af878875a3e0fc1a3ab97cea8cd8eaf68377c86840ae680f285893d485c3f521304be0d99751b3a7498dc

    • SSDEEP

      3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QvOYiEyYFarnufJIIn:ZJ0BXScFy2RsQJ8zgZyYFaifx

    Score
    10/10
    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks