General

  • Target

    2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.bin

  • Size

    118KB

  • Sample

    240812-j17g5ssdqm

  • MD5

    9c08dfc58885a9a7beca989ea5ee9108

  • SHA1

    ce2f51348da7a19dbf0e79b64f9eb8e46f45efa3

  • SHA256

    2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e

  • SHA512

    34cf39e4976f264f31b3236cca87aeca04ebc447fe99b35bbb72dd126462eed78310954fcdebab48b1f3ad9eaf5efe22ad8405b12d80ddd357244138067a1ae2

  • SSDEEP

    1536:pRGfmACfvCHeQ5EJRDKiMIfB6Ym5p/eyxICS4AxpoC3/0bZ2YySvKxBPyAU0DeWj:omRj6YaWm8/0bZCSvKDyhVv

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$n1J5.fM58bdQxg1IiAWkk.PuUeYhAcGlSCgxM6CJQ94aF.GiJ58eG

Campaign

6758

Decoy

mezhdu-delom.ru

songunceliptv.com

basisschooldezonnewijzer.nl

justinvieira.com

iqbalscientific.com

memaag.com

cwsitservices.co.uk

paymybill.guru

mir-na-iznanku.com

anteniti.com

slupetzky.at

delchacay.com.ar

calxplus.eu

jolly-events.com

irishmachineryauctions.com

solerluethi-allart.ch

schmalhorst.de

maasreusel.nl

sanyue119.com

lescomtesdemean.be

Attributes
  • net

    true

  • pid

    $2a$10$n1J5.fM58bdQxg1IiAWkk.PuUeYhAcGlSCgxM6CJQ94aF.GiJ58eG

  • prc

    tbirdconfig

    firefox

    outlook

    encsvc

    sql

    xfssvccon

    wordpad

    visio

    thunderbird

    infopath

    thebat

    msaccess

    dbsnmp

    ocssd

    ocautoupds

    excel

    isqlplussvc

    agntsvc

    ocomm

    oracle

    steam

    powerpnt

    onenote

    synctime

    sqbcoreservice

    mspub

    dbeng50

    mydesktopservice

    mydesktopqos

    winword

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 300 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Personal Data - Banking data - Strategic sourcing - Management - Projects, plans - Immigrants info - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    6758

  • svc

    mepocs

    vss

    sql

    memtas

    sophos

    backup

    svc$

    veeam

Extracted

Path

C:\Recovery\ba13f242-3a65-11ef-94cb-d685e2345d05\5ff5vl9-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 5ff5vl9. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 300 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Personal Data - Banking data - Strategic sourcing - Management - Projects, plans - Immigrants info - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A2926C1C661E195F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/A2926C1C661E195F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: UZhIAgWwqAzBPJgdZCpHEYKPWryYXrLA4/OonxRND8pDSRkLa/xSGCTPPReeKMqp OlvcJ+/T/h37LChBqhux+aWmM9M29rcDBfuj23dnPrTkf2ui/H3yMHlosXJozsTm sXwa+s846rk1Q1nQ778MCYiTaaSWMgi2tMMAd3k6rEmT7HD/v/IK3Y4Fc5R77cu1 pEVaqBab3Pe2xrS2nRFnu1rDYd/Jrs9MohaPXcBi/MTi4yLpYInRUPaIAlCFNgX6 IUM9VAFqwRc56L6fNxvpXQsJzcwUNz258laR+qc4YllvKvLIKmFlSoHE6fWpm+z5 OHHTe9v1CKTY9kf9eN/82o/N010S2pus7JDIVAtMF3vOVAld3otb/O69Navy8UU1 r52DfOpa85GdhbrgdezefiC95hkvpeqtCj5r1lDdQ72sAkLplsodlIzXVjwnzOo1 mVFEqRX4TldHUInm5B9MJ8GLzm3mIp61i5sUL9c5juwYLOjaOFNRytjpmd70G88T aD/fTMCfKfK6WqmmCYs97hGpJFDscgrB1O4ntLVkKrvXZGZ8R5zCOvqDmr5LNIhU AiJDS+nCks/b7U3cxee6jy7nu4WKhwZmYoIkgfbKNkWO8VBXCNw6e2it1x/q4NLA 8HJouo+OD7Lry5ita1dz24Wq1aXdS2RXiP+cvQFnx3YYnQBUDbFeT1KVaZs7sTvp SBCy4Fht2zWC5guyX2q1OFa9drBZUrZr7yThSVoIi++4JWwCUS72s1IlK5479O5s 5aV3O3pd8mxzQpNPJTnU5O/Maf0P9kN4x+Co1XbLcOnnpSFB4KpJI7Mez2qA3ID2 rh7MIy1hoTdbTKULOJ1Fv+P0ErF5apMfMQ0QNSUfa3ZsIIIRnWLq3zqQxua1Cz4S 8wX+joDXCPYgvScmrkfylcgmxKIjOb8t+Q9rxjWR4LojYCgLMhMI5MQlWuz1VVLR EGr7RH3UqU7hkTV3T7DaauiDn3RKrqbKlboutKaXBHIknftKJzB59eZmP3Smmj1o XuMJB/Pz6hWRbmCr9auIAhDMInaHY0tuLipfmxVddmGgxnvb7ncbEKiNyx73/U39 80uRKPxHeMYOOdOKZZpMwipEEGJN9U9iYrvTkz2A/a3umvCuvB4/UawUSI73JbJz WT0Rc5sSgOSoFZITPE20AFHghs40QPVf0HBhOOS4+v4VEyddybqdAJEsE+TZC9qD CvkqcKSjYZewcVjr6QRuNaP/hqd9fqcd2eilxN8lSFFmerF5ldS4iCWO2/WU+4Gv bXJNd6F4RNS3JX0/ZElbA9fW8goekA0PXshSBJk6t02b9gtecj2ohstVER2ghUt6 uhNUWPnrUyYZn0Bz30QchDML3JKYtewLs6Tqbshf2cavIg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A2926C1C661E195F

http://decoder.re/A2926C1C661E195F

Extracted

Path

C:\Users\Admin\ual2r25f-readme.txt

Family

sodinokibi

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension ual2r25f. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 300 GB archived data from \\UDATA. Example of data: - Accounting - Finance - Personal Data - Banking data - Strategic sourcing - Management - Projects, plans - Immigrants info - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06F651B76F549E36 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/06F651B76F549E36 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DPhn+SpwLJLW/oex3iwg6OowPaOwZK/mvBkFoIMSaalhix19T5gx4LJZNXzfJ+Vp arPi47mu7DseICCIFoPbDvwgj2mw7SHyY86E8DMohW8NsVJgW+US9BgMkAQG0wwh R7mesXTpZEcKn7nzsrVU2MtT/qWrEFagWZBOrMIqIqAPbmIKxB+rY+qhInPtvsBl CtT7KBDtuIPICqC8V7GT10wwxjvuhdJrOWNxtenADcxjShEmdMa0EpS4rARw2kV2 pRm5QD/sbnTlIHlDEG0W2u6m+8IPvOfACQv0WTRv2VMlI7j/mRx+2D7d89mgYnp4 4iONlgz1tS31ZrqvWatuV0vn86j06niX22okQvgsa08vGYXFRqyzNo5/0N7s1jet vdi/PIp+NJuMzAMPGGy5mbixy5rblv6au6+OTODUVOAcn2v6VGrtN/YEWcsNKnbh hfVYplyDyONdCz+RojG2hhPdBL/O6cpQWPP1IuOLHJeGEgeNSM4cTKBFW0fWaSS+ WbOC3w5D4Nhcy/B/h50+n5XY7D1CiM5jXArPazSqzW1qtxgnlZOWKlWzn/qVC8K2 iqV5hqhFAmNHuBU11uumW09R5BtgFPVDgtT9CHiiiv/1MHVo/GynbUWYmxtupEnx L8QxzqkPOvAwPuGEuKR0/MwdRc/8+Cg+TOD76k4q87L9qVAPS1Pc/zZCHIlk+RTL u+6GgoI55gvG8o3Sz/8UeeH5IhbXjIAZ4GGov6NVs4E8p04dcei4Tp4vobz+yvhc /at1ARNqtvyUpeOEyJdvZGQTpTrdZ88Yfg9y3pU0b90Ni8yiP7iznPq7zClpu391 L5rPbgHgy8jFgsX1qFHnEsoKOT0e+8N+lzoiIj5OPPJri1qdhMQ6riNLDVAJT7Hd ser9zDB3FeOZ9WMcgpKsgGYAtXgKe9wShEUaJzxfNE33SLJjTiQIHEZKeOBFmAAT bA2t26Cm9Q0Y8ONZLhtwPihyJJZ/rO2VJThLz3CfaQOS70tAhsXVyJpIJm6cC6mj EZFP/6NEeVqR/KnzbcqdhC9FT6RHhL+qNW9MhB0NSSlL80HJmvZethPZgMmbmUGG tAbDPhS3gejhEkuNxCIHN4HDBuQlIoLfgodqmE3K6xYGEB3f7HNi8y3l2d5ZNGAK qO0D0d+TO1bfS4LqmHXCPGIVIwp6eLZgktl1ZOBjar/S/+hgCvTM60Z7O8AGZUfY nctkz+ApzPZxRN6uLiAPSiDJ3bn55l1APGGexbvsTH3Bi2oRGRCOSYfo/UTmFPOm IznMljiL/B1GeTRBt3rSIDU2GSqG30Vsx6uHk/1CvrDItxcu71aZaTrRRCJ8dHTc DHH9ZEyolyUg+UU5IEmEZuOvZWbfByvntI1osQSoJfJ35kL3MQXGVfFl ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/06F651B76F549E36

http://decoder.re/06F651B76F549E36

Targets

    • Target

      2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e.bin

    • Size

      118KB

    • MD5

      9c08dfc58885a9a7beca989ea5ee9108

    • SHA1

      ce2f51348da7a19dbf0e79b64f9eb8e46f45efa3

    • SHA256

      2aef1134cb696c922a06b71d58058d44e804391ff44cc5cd54335a1438fba58e

    • SHA512

      34cf39e4976f264f31b3236cca87aeca04ebc447fe99b35bbb72dd126462eed78310954fcdebab48b1f3ad9eaf5efe22ad8405b12d80ddd357244138067a1ae2

    • SSDEEP

      1536:pRGfmACfvCHeQ5EJRDKiMIfB6Ym5p/eyxICS4AxpoC3/0bZ2YySvKxBPyAU0DeWj:omRj6YaWm8/0bZCSvKDyhVv

    • Sodin,Sodinokibi,REvil

      Ransomware with advanced anti-analysis and privilege escalation functionality.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks