General

  • Target

    3ec350b912bf27249dfb93221a4b7a9b_JaffaCakes118

  • Size

    116KB

  • Sample

    240729-llj5eawale

  • MD5

    3ec350b912bf27249dfb93221a4b7a9b

  • SHA1

    2142fe0caa3f08b98ffe6b3f9ae82f4bfb5f3abf

  • SHA256

    93bd21cb6331ce96cc28dc7a1f0b6b2b2ed8ec064d2ac6e1f428af59c924cb57

  • SHA512

    1e54a3204d8ca0665617093e725f3e32d46ffeef3b25f019cd5039dc1a24022d52d595bc2bf1a630985b8f1899ed01fbe22f9a943f9037743946b2cea3379d02

  • SSDEEP

    1536:CPp8kFF4+utlznGEvCrUmUYwGOmpX2yaICS4Aa7AYHiqcrUzSNYr:8vnuGqfGOqVBWitN4

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$TwkvA7Hj3AL2xYkq8mKSW.6dTEgTj044NesFTE/dAutXOlSsFEzDa

Campaign

5442

Decoy

mdk-mediadesign.de

i-arslan.de

seagatesthreecharters.com

grelot-home.com

milanonotai.it

planchaavapor.net

foryourhealth.live

xlarge.at

thaysa.com

4net.guru

vyhino-zhulebino-24.ru

evergreen-fishing.com

myhealth.net.au

assurancesalextrespaille.fr

ikads.org

themadbotter.com

highimpactoutdoors.net

aco-media.nl

hexcreatives.co

hvccfloorcare.com

Attributes
  • net

    false

  • pid

    $2a$10$TwkvA7Hj3AL2xYkq8mKSW.6dTEgTj044NesFTE/dAutXOlSsFEzDa

  • prc

    thebat

    wordpad

    winword

    ocomm

    thunderbird

    outlook

    synctime

    firefox

    dbsnmp

    xfssvccon

    msaccess

    infopath

    mydesktopservice

    excel

    mspub

    onenote

    ocssd

    sqbcoreservice

    agntsvc

    tbirdconfig

    isqlplussvc

    visio

    steam

    dbeng50

    mydesktopqos

    oracle

    encsvc

    sql

    powerpnt

    ocautoupds

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US [+](USE TOR BROWSER) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/164?s=8461e11922fbbd5471dfee87150dd27c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    5442

  • svc

    mepocs

    vss

    backup

    sql

    svc$

    memtas

    sophos

    veeam

Extracted

Path

C:\Users\a69y87wi3-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension a69y87wi3. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US [+](USE TOR BROWSER) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/164?s=8461e11922fbbd5471dfee87150dd27c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B90860DBB5007BF7 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/B90860DBB5007BF7 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: krsGR5JZPspf1B7Bq22DApIiXU+GyfmwmXQgTaNKL9laLznGSq/FcvzBHPUhBUkL X+4+ZOWsbeDFLlsV5r3oCOf7pto9rVyYDcRagrgGxdNF8x8/kA2sWI0qAVIP9vBD iANjIBrm7MW8JZzxMs9QVqA2rWiyK282MM3T/7w/2W8vkG04I/tZTNihyPflPT5U IrDzsWmAMoCKdPtItvzBScoOwEI+joej92OTtNQfHZYlr5JvN0vn9DQ/Hd2+U0gY 5CSsluGRtN2NOB8UnNVOWbwyoYFPCByUt4Se4PC/r55sDlDHFjHNf9af1lk6X6IH 7iA1nvrr1nV6RynES+ExMAB07ULM8Uml0pvl2EJjVxIrIpA2983u3gX6CQ9f4hQc TCQjsZPJgSnKQymMElaw3jp4VZ8BYj0p7KYUyqIYJUFy1/VwH6cSnSQxlEFoAzfS N9Ja4ZK1sLqzngtxigu050vN2nAEdU2zYUG7XGVw14h6NhWXEGelN6WyPHaYMUIh 4V3ndxrVcg1cbiOy8t7px/TLdSCNhqI7QWvQ0MZ/QWEubjJsosnOzFCR6OERGp+B nlWPNjeIamVDtY3k0ETtWwtz33Gmp5X7yLmQJ3+JVtpoMFnpGFQzgvSikJJEdGyY oSr7gQIKeqWftzEgmCAfVQMDf2pa/vedIKH+yV0tJ4wOZtQ7/hBjN11Ma0ec0cnc g+c6ClZrx9dfbXndVbCbBxqbeAVPZATqZm3cQi5Ar2JXix2STiQFicln84OGd755 pUk1GO3duCz5dHJT5KGvFgo3g/qVZO8e/InsLGUU0Z/XGx+pP5BoJLSZQg1IdDDm bagBP4qWyQIDEeSPXsw7a1Q/I4SjzJdpLLyvEtDgMM4bjqJgsR46rUCAOu8L5SlM /w30ru2uZTQd2nUumgxAq8pIW5OkFqYz0qMtcVBh10gFCBbU35Hvgu6JmcchcUQL KTxxlgorypYcDDRH+zguwHuWeFrVSE8+af1vUfYkaOwZfHM+Opg/afmwImK/B9+4 LtrChOwjUtWb2MQ/ovmuQQfLzwBuogi/7evyo7cVLpMXd5Dt6hXqXE8COEzY9THU gLPlQ5fRkQ4/iYLcaDjWhOvysej4I44u10jOWgBblvpjMnOXxzt9/Di6JTMueo0a uVnu0bvHaN/X+VCrKbUgWT8xNmnO7Ggw+SpI8aM3yEmoyoK4mtJcGjd0XZC3jZnq QTZoZRFBGLmQ51nEhczaL951n896Q4xl9zRboRCK78qDGertGzTuy/H1R6kAjmeM Y8yWrbnNJXgtc1v8v33oa0Ne0rHBzG7xQ69Lu6I8JHrBzvq82eg3h8W2CDkNp10R CChMTCS7CghYAvU3iZU6JtwniUbBUBjw0RgbwP/I6b37NNeaoHQ= ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B90860DBB5007BF7

http://decryptor.cc/B90860DBB5007BF7

Extracted

Path

C:\Users\14s1s6lk-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 14s1s6lk. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] WE ARE READY TO PUBLISH UR DATA TO PUBLIC ACCESS IF YOU NOT CONTACT US [+](USE TOR BROWSER) http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/164?s=8461e11922fbbd5471dfee87150dd27c [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/86778E0E43FEB2FB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/86778E0E43FEB2FB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DT/88RqTtBphWSspe8XGuNS3oxaf2wxBGeMepbue8LY/fJkZElL71o0zhpQpliQs SnH/lxuPbJTz9dXjyrGE/dRuz+d7AwG1PiMuDR5wfep6dRFp1sSp5NO6PVcUM7U7 0t+pxcqHldZxtyAGJAH3pHsrJ5PdclqC4i6cKKe+W1Vxp3mlgx+8Mi+AUKZEoveX K6nRnj/n3oMPLHb+Dis3WspN0++LGri1zxbwdc0rlt+PbrtX3StybWrgG0Y28j9C EhzHx3sxiJr0ViuQb9fy9jhyue2drYZ9hkEmR3EQDRekgApfFfKaUtyn6bSPbhrg FQxKWBRl0fZ0gLKDvV7Lw8xGir0B6FmImckUeApeMCQnw32fgn29NA4ft04HmVif TK5uW8eRtxB1jcCX7+MaDoSwweIS19OdsFEiGgBVux+VVInUSatU9UmYQgoNWMOQ iGQQw2MKfIimnpCZOj2RfuF0o1y1LPxmO2jAdrpf1XHPbZWkM/owAB3miJCq7ARW 6lFfHaaFC8TRfeW2bYU6k5BSnlHVE+Z4w08IuMaKFhFCl2ThTid6TKhHUFK3okEO k/8DrlhalG1cwy0IUMuMdVjWry7fST6VSj/5LWzG21GzIay95sxG1NBvRy+E/uPa 7cDtkxNuRccape92KUbd/UIVoV5EH/fTHNBn5BvVWtQ6eGXGJE7mxJ0X6pOOBlHM 3gzxLrTuM8HaZ9QeXezRaXZB6FTsY7lZYBtCCOvFedSInVXHA7SO1+2KW8oUEfY8 dQNMdcpzjc1t9869FcR902Pna34M6EnLWr87vFVAM2ePix7yeK5rC3cshPGA/4bK D59o7FWPqPDeKsTgEFp8w0xZfiG37WeUDskm6c4jcVJxWFt310d2XddWNe43rmHE lD9l/t6ZuitI9gvXPA8IZlSvenCQ3xBG++LGEN8c/ZnCkf1rHjrC+ylElYww763o I3+3m19V59L+AWCrxggs6/D0oJzlnhDg6b1AVB5hK7KECr8DHEZeszOFeg4o+WN9 22RVgogzH7Mlk2LXBgX8EOiNWis5x9ZcjwtX4h5l8EDjGvlSUaaeDty7vevfQ/La SbYOaZ8xAZyz99b0duVtZiwIWhB08QnT9SXQJZI3w2poUOgG7wNozGH427WUE0/R qjADw8MZdoBxZdv1GB1GwYxpv9dwaPepKZPivluDnUJzI2SN0Qh1ue3ZGeVdi4E/ SKkzBGp+YV3sI/+GJIQn/rQyF2pwk4GVqdW7c2YoKU3si+0XtdqN5exHwQxLoZFq 3AOH9HglbU8RCC6KhUxbaLIDLXvS8/pLWiChXL472mPzNwPeE65VEg3qTV4WtT5E sDgJPDa/FGeBnigqK0R1a5YYVCMLPR/uvJtEbK26bJvdbOLMqsBhkTxs ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/86778E0E43FEB2FB

http://decryptor.cc/86778E0E43FEB2FB

Targets

    • Target

      3ec350b912bf27249dfb93221a4b7a9b_JaffaCakes118

    • Size

      116KB

    • MD5

      3ec350b912bf27249dfb93221a4b7a9b

    • SHA1

      2142fe0caa3f08b98ffe6b3f9ae82f4bfb5f3abf

    • SHA256

      93bd21cb6331ce96cc28dc7a1f0b6b2b2ed8ec064d2ac6e1f428af59c924cb57

    • SHA512

      1e54a3204d8ca0665617093e725f3e32d46ffeef3b25f019cd5039dc1a24022d52d595bc2bf1a630985b8f1899ed01fbe22f9a943f9037743946b2cea3379d02

    • SSDEEP

      1536:CPp8kFF4+utlznGEvCrUmUYwGOmpX2yaICS4Aa7AYHiqcrUzSNYr:8vnuGqfGOqVBWitN4

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks