General

  • Target

    2024-07-25_72d9db37db04e51f61fc7b3424a009d2_revil_wapomi

  • Size

    139KB

  • Sample

    240725-ltj5da1gqn

  • MD5

    72d9db37db04e51f61fc7b3424a009d2

  • SHA1

    3be50ec5fced0b0f0e9f1795ecbafc7538f28426

  • SHA256

    ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae

  • SHA512

    be13842d7b615579714ac1dab4f43e11207075a4a3d09ec2aae2c87727ccdde2dece33c2394b20e0e669cd03f8c8f42924bf8d6cdaf1ab9489d9b555fb1a4281

  • SSDEEP

    1536:+DvcP3aXhpshwVs5OE8yNcYQpG2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOx9VG8:5lSVhaNcYMkgnBR5uiV1UvQFOxXGCH

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.

Campaign

4085

Decoy

sandd.nl

digivod.de

southeasternacademyofprosthodontics.org

resortmtn.com

mdk-mediadesign.de

tetinfo.in

fayrecreations.com

ecpmedia.vn

physiofischer.de

highlinesouthasc.com

antenanavi.com

blog.solutionsarchitect.guru

deepsouthclothingcompany.com

coursio.com

quickyfunds.com

atmos-show.com

pawsuppetlovers.com

hokagestore.com

midmohandyman.com

mmgdouai.fr

Attributes
  • net

    true

  • pid

    $2a$10$CtL6MpBCOZZcR.aRU3GXp.pcFtg0joF6uPmmrKY0hC0o.x.alLtZ.

  • prc

    sqbcoreservice

    dbsnmp

    mydesktopservice

    outlook

    ocomm

    excel

    mydesktopqos

    isqlplussvc

    onenote

    tbirdconfig

    msaccess

    encsvc

    infopath

    steam

    thebat

    agntsvc

    sql

    visio

    wordpad

    winword

    dbeng50

    powerpnt

    firefox

    xfssvccon

    mspub

    oracle

    thunderbird

    ocssd

    synctime

    ocautoupds

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    4085

  • svc

    memtas

    mepocs

    backup

    sophos

    sql

    svc$

    veeam

    vss

Extracted

Path

C:\Users\08l11gua9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 08l11gua9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C422BF20BC7E7442 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/C422BF20BC7E7442 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: qEfVzEajFrK9DhO1wN5+o9VuxQ3cswjqAwjAND90pjp/r572WjvaLImFp+5k/C/A HnG/bwCtBItbxT83oAnRE1sUSnQvlrQrzgVHooOC6XmXJbKURJ8+nXySXj9Rk70V ntkmouWiFV96sxYdkSivZHPp73CSTOU3Xf4F8v/0HRPD2rB4UActkm7h7L2PHIe5 6JrBDzZIxMDF2xc1sB4VT81+U2noyJovbNTAvUJ4dZipv3K9rZxE0KX8dkcHFGDM 7l8Ogguw0QDCSr3UYrjpcfH65oyqQcvqnL2uayxaPuRyvsDVYj/tOeZXY5vK6n21 oX+/N7zegZcurL6ANd6rbzFCom71lJZEW0uGkYqzlF4NPtoKc+hE4qD3uyMnzqYH LMVTFWoOQeGIvYQCFRQUp3UrYGPKy1XzgXrDGf88UH741riZ/6z9A9ME1XqG84t1 kuUnebM+t9DRYF2Mf6giH3J9z8nLsyTz3k4B08qDJ6r4APMUwo5wMpOMxu5xfHcb r9qZTwlMtOMccA9udav81zEkPBNDcHlguF93bLh0JvCVxT5G4xR9tZQzpCaNpnsR 68N0oV4UcHpfN2m7zgfiPDHoSMcviZTrRolwgokB7nOGy2q58fXtSghnrg9jDYlr waf1bb59R3sgQLguMaRE/wj2QO6P41N4TAMVDzmvc667APh03CPI4X4vs9Yl7WHm OzpeOruCT5fAGmS21BYbUGAEc6Ylh5NoSYV28HYdJl+5SuR0wLMgDzy9B+ADM6mx 4KT0UYBi9SY30cc230qmLn9NqnLL3Xmj/QzUCZbQHkCJBqH/f5Dqu8CRlXLncL2p YWzPsiaMs62V4CHqW2binshO/sQVjAIxDw43ZLSJGo2CzIauzooQtQm6JL2xCI8K 5YJ1+WGcI2ABbn7yMF7gq8F7MvAT9aehw3VwPCbmyvH8f1G20hpaIbAfy/YgXVzA jcVklVTHYDEvY9hopvAQ7KfReyTYcXhTTwqB0SIruFvkt9v0rs7+T5UDzP7MA+gR AZxghqVroHBWwaxX3EkR5fCoaMALNIZ5YCQJlkf/7HtmkT/Fk3KmWiuDGcaaGzRm WCn8UX7cpFg6+rqSOCQRLCGTOtzblRLcj6aXwUPLQOd7wF7v8nNgdZyqDROac3M4 Bvd1bnrqLAamJ7Mj19A1417BrnIDTl9KVwhNU6YeodyRb3EdV3jGBvmfYkHXuY3E 2vzoeeIMd9+cY3OMi7kQbrZ4klm1zvX/LzfXdEUy7Xyec/dJmtiXABmWsN3Xocwn hYM921XJOiUE9tMTnLL7N6WQOulpozZl6DWeSQ7Mfa7tUGQD3wYzOig0BDZ2PA3o I9Owiz/4kPcyhcBSKBvDOoVjzByjf3qXvB4jSdMt2xV7cXQjNtY= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C422BF20BC7E7442

http://decryptor.cc/C422BF20BC7E7442

Extracted

Path

C:\Users\ig792q8-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ig792q8. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D1DFB55CB49EFFB7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/D1DFB55CB49EFFB7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 1NOw06lKixgW118gQioNz7ML88YggB6vwB1IDCO4HyrJPtX4VTFI3DIPro5wyJ0Y wVLZ4m7D39SvHqZqRK7lhlBnm8KuCi4aFd0KY/9O9CvmsuzLf5Y11ZcJLzEU3sVC Mo8E+k/HLgFnjOZT8ezy8N4wPPF7mNETwzEoIfhTs5S6xs+LZw9QcJXXvLhW7+eV 2sOmVBb+i1dbc47CID84C5H+c07KQ/JoaF8lAzEv27L9uxYoX0QE7qW9pMUxlg5o MzTUkJzW5aVz1iQGEqgjQVxELiD2ZsCQDh2lWOZjYXyf+iF6y7XnK1OsnBppqEVW yHyAcuvgetASn5LM2CQZNCqSpAcZO7EXIPHN8m3MM4oDA4yrDa1JftTENLAn2oJi 4S1Qfzf4etQoZbkFlIQ6tMHtzBKR0GAZLU69Sr+dpvl/C++vCZsfjPZdDE0T5KIw 1sKsHUJeXJ66FW46cH3tv5DY/9Maxkh8THyUN/Xb2fDZUBYphnBwwM74bRMd/XgH QMbS7IYH5CR/MTNwyl0V97fk2fFisnV47XuKHEcBLeR5xidJRenZYYwAEyT7edVu nDtrH+k/6msSGv9p5vBEirR85HUdVtJRkNo+v+An9n3AseWlgZWNa4vFzolJxVCc 5ImfM3q1ZbLo0cUNRRMaYri2Wxu/wPDUaHlRBT6mnb4Je3p2VeYjjylk94etfdQU G73sAHc9Kpzxx8mfFNqHd3WkkLxibCunCPcDp6oDClLRM2ooWeUmpKnFRA8Y1YOy rfhNyEONDODgXFzcj0CghthBAIoh/FAHZHJrEHetUDXHUx9y7PRn2PglTpgrdmlu mU5WfKNQvbPHlPJB0sefTZpv/QjdH4QSiWHe5WyWz1SMNscksvuB7q75vsR16eww xa3mvaIOGY4+U/6tM++MkFWeO677iLWPxgNyt8erqiy3ZiTdyH/DigEevJ0zk/Fm t19dLMoBWBXH3no+/D956rWz1Xs+A26rQ2JZfH9Hlvu//yB39OFCS3L51oqlyndo jTI0ln4M0xgt8ZsbMPFcVxie6ky7qIw8JidvnEs3Lcmz3+Bqhq3bCCm2L1eeDgPQ c2tPCbIk/VGCsrbNrHUYuRc3nV4AHSr+x17aAl//JTepsbjpiAGnJz6KykfcvPFi DnKjREik7Hwbp+bpO3fLFJL9M/X4vX0z3eaCO9xoxu45LwGGf+fGiLAVqH7v/eFn xhzOz5T/9SCIrOsEM3pXVm0GVt9UL4jjB3pq75US0JZ01gDqsmDpg5m1lAlU7kBD Vvymv5kG12qwj0kgZG/3CEwyK2Kl6SvGyGTvygOwkbckpM2ZpQ5I+aPidueiFqpK IBW4WNp3hYp1O05Uno3BqLsMDniJtTNOgZyBnKHnGl6C5Tz8IOwN0g== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D1DFB55CB49EFFB7

http://decryptor.cc/D1DFB55CB49EFFB7

Targets

    • Target

      2024-07-25_72d9db37db04e51f61fc7b3424a009d2_revil_wapomi

    • Size

      139KB

    • MD5

      72d9db37db04e51f61fc7b3424a009d2

    • SHA1

      3be50ec5fced0b0f0e9f1795ecbafc7538f28426

    • SHA256

      ff6a62a956cfea3ed97e71f58a3554b1caaca3275d90ab5ac7b280aafa9c1cae

    • SHA512

      be13842d7b615579714ac1dab4f43e11207075a4a3d09ec2aae2c87727ccdde2dece33c2394b20e0e669cd03f8c8f42924bf8d6cdaf1ab9489d9b555fb1a4281

    • SSDEEP

      1536:+DvcP3aXhpshwVs5OE8yNcYQpG2ZZICS4AIjnBR561lQVMr3IgmffEbjQFOx9VG8:5lSVhaNcYMkgnBR5uiV1UvQFOxXGCH

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Impact

Defacement

1
T1491

Tasks